IDCF Cloud, provided by IDC Frontier, was hit by a ransomware attack, affecting 495 companies and municipalities across 4 zones in the East Japan Region. In its seventh report, published on 27 October, the company explained that the attack exploited a vulnerability in open-source software and that no customer virtual-server data had been confirmed to have leaked externally.
At around 3:40 a.m. on 7 October 2026, IDCF Cloud was hit by a ransomware attack by a third party, and the damage spread across 4 zones in East Japan Region 1. The number of affected customers was reported to have reached 495 companies and municipalities. The entry point was explained as a vulnerability in open-source software used by the cloud portal's authentication system. After the attack, the attackers illegally obtained administrator privileges for the virtualization infrastructure and reportedly shut down and encrypted customers' virtual servers.
It was announced that unauthorized queries to the “IDCF Cloud Portal” had expanded to involve up to 71 companies, while up to 31 email addresses that may have included personal names and other information were affected. Meanwhile, following an investigation, it was determined that there had been “no” external leakage of data within customer virtual servers. It was explained that additional time would be required to restore services to affected organizations and resolve the inability to use their data. Login passwords for affected customers were illegally changed in up to 4 cases, and the customers concerned were instructed to reset them.
The resumption of “IDCF Cloud Backup” in unaffected environments was announced on 18 October, and backup data could be extracted for 206 customers as of 20 October. However, the ability to extract backups does not mean that full recovery has been achieved, and the portal remains unavailable. For individual services, announcements included the end of the current SKE48 Mail system and its redevelopment, completion of recovery by Media Link and preparations to hand over backup data, and Broccoli's report that no customer information had leaked.
The affected parties and recovery status related to IDCF Cloud reflect official announcements through 28 October, with a policy of treating recovery decisions and the results of personal-information investigations separately. Overall, while any major data leakage has been denied, recovery work, including reopening the management portal, making use of backups and managing contractors, is progressing in stages.