Japan's cyber weak point is backups sitting beside the attack

The headline is the attack, the constraint is recovery

IDCF Cloud went down at 03:40 Japan time on 7 October, and in a second notice that day IDC Frontier confirmed ransomware as the cause. East Japan Region 1, in Shirakawa, Fukushima, was taken off the network; 495 companies and local governments were affected. The Ibaraki prefectural website went down shortly after 04:00 on the morning of 7 October, and shipments stopped at all 17 centres of Nissui's logistics unit. The headline number is 495, but that is not the measure of the risk.

The real measure came on the evening of 8 October. The third notice said virtual servers in 4 zones could not be started and that extracting or restoring customer data would be difficult. The company tied recovery to backups held by customers themselves and advised them to rebuild in a new environment. For each of the 495 customers, the question is therefore the same: is your backup outside this infrastructure? As of 9 October, the attacker's entry point and whether data was exfiltrated had not been disclosed.

The backup's location made the difference

The same attack produced very different outcomes for two customers. Six Apart's Movable Type cloud lost 31 servers, but it kept 7 generations of daily backups on Google Cloud. On the morning of 8 October it began moving to Sakura Cloud using the 01:00 backup from 7 October. Soliton Systems, by contrast, said its own backup servers, held on the same infrastructure, had also become unusable. It decided to rebuild on a different infrastructure it had vetted.

The public sector looks more fragile. According to MLex, at least 1 prefecture could not reach its own backup once the provider's systems went down. Kodaira, a Tokyo municipality, announced on 8 October that names, addresses and phone numbers from application forms may be at risk. CISA's ransomware guide recommends offline, encrypted backups, backups across multiple clouds and regular restore testing. That separation is exactly the link that failed in the Japanese incidents.

Osaka Metropolitan University showed the same pattern a week earlier. In an attack that began on 2 October, about 500 servers went down and most backups were encrypted; data on at least 130,000 people was put at risk. According to SBS's compilation, unauthorised access at Times Car leaked the personal data of 6.6 million users. Trend Micro counts 600 unauthorised access incidents disclosed by Japanese companies and local governments in the first 9 months of 2026.

Why now, and where the state actor fits

Concentration explains the timing. SBS's compilation shows that in the same period up to 220,000 customer records at Daiwa Securities were exposed via a contractor server. In July, data on about 246,000 civil servants was affected at a public-service contractor. The attacks are not hitting institutions one by one. They are hitting the contractor and cloud layer that hosts them together. When 4 zones at one provider fail, the recovery capacity of hundreds of institutions is tested at once.

Japan is also on the state-backed target list. On 8 October the FBI seized 7 domains belonging to the MicroScan and FishHub tools of Beijing-based Integrity Technology Group. BleepingComputer reports that airports in Japan were among the targets MicroScan scanned. The FBI did not say whether that infrastructure had been breached. Japan joined the 58-page US advisory alongside Australia, the UK, Spain, New Zealand and Canada.

Ransomware and state-backed reconnaissance feed on the same weakness: an internet-facing management layer, with the backup sitting in the same place. On 7 October IDC Frontier also shut external management consoles in its other zones as a precaution. That suggests the provider could not rule out the attacker having reached its management layer. Until the entry point is disclosed, this remains an inference.

What comes next

The first test will be IDC Frontier's fourth notice. It should show how much of the data in the 4 zones came back from the company's own backups, and what the leak investigation found. The company has reported the incident to its supervising ministry and the Tokyo police; an outside security firm is examining networks, servers and storage in the eastern and western regions. If Kodaira files a breach notice, municipal data will have been put directly at risk by a cloud provider attack for the first time.

Over the medium term, expect public tenders to require backups to be held with a different provider, and cyber insurers to add the same test to policy terms. If both happen, Japanese institutions will spend more on cloud by adding a second provider. If they do not, the 495-customer picture will repeat at the next provider attack.