IDC Frontier ransomware has disrupted its IDCF Cloud platform since 3:40 a.m. on 7 October 2026, affecting 495 companies and local governments. Six customers have reported member data in scope, led by the JR East group at up to 6.09 million records. None has confirmed data was taken.
How the IDCF Cloud Attack Unfolded
IDC Frontier is a cloud hosting company and a subsidiary of SoftBank Corp. It published its first notice on the morning of 7 October, reporting “unauthorized access by a third party” to some systems from around 3:40 a.m. that day, with East Japan Region 1 named as the affected scope. A second notice issued later the same day identified the cause as a ransomware attack by a third party.
Customers in four zones of that region — named tesla, henry, pascal and joule — lost access to their virtual servers. IDC Frontier set up an emergency response headquarters at 9:00 a.m. on 7 October, working with SoftBank Corp, and says it has engaged an external cybersecurity firm and is reporting to government regulators and the police.
Two of the company’s other products, IDCF Cloud TypeS and IDCF Private Cloud, are not affected.
Which Companies Have Reported Possible Exposure
Six customers disclosed potential data exposure on 9 October 2026. Every figure below is the maximum number of records the company is reviewing, not a count of records confirmed stolen.
| Company and service | Records in scope | Data fields involved |
|---|---|---|
| JR East — Eki-net reservations | Up to about 1.67 million | Email addresses only |
| JR East — Otona no Kyujitsu Club | Up to about 390,000 | Email addresses, membership numbers, card expiry dates, dates of birth |
| View Card — VIEW’s NET | About 4.03 million | Email addresses |
| JR Kyushu — web members | Up to about 1.3 million | Email addresses and email log data |
| Peach Aviation | About 1.89 million under review | Not specified; no leak confirmed |
The 6.09 million figure in most headlines is the JR East group total: roughly 2.06 million across JR East’s own two services plus 4.03 million at View Card, its credit card subsidiary. JR East added the View Card numbers in an update to its 9 October announcement at 5:26 p.m. local time, which is why earlier reports gave the total as 2.06 million.
Smaller IDCF customers reported outages without any data exposure, including Takashimaya’s Select Square, Nissui Logistics, Cyber University, Fibergate, the Japan Badminton Association and three Shiga Prefecture websites.
Why Those Millions Are Review Scopes, Not Confirmed Leaks
None of the affected companies has said that data was read, copied or published. The Japanese disclosures are explicit about this: JR Kyushu’s states that about 1.3 million is the maximum number of records in scope and does not mean that 1.3 million people’s information has been confirmed leaked. JR East’s uses the same construction, saying it cannot rule out that third parties viewed or obtained some customers’ data.
The 495 figure is also narrower than it looks. It is IDC Frontier’s count of affected customer contracts, not a count of breached organisations or of leaked records. The per-company figures are review scopes measured against different services, so they cannot be added together to produce a single victim total.
None of the companies has reported any harm traced to the incident so far.
What Data Was Involved, and What Was Not
The exposed data sat in an external email-delivery system rather than in the companies’ core account databases, which is why email addresses dominate the list. JR East, View Card and JR Kyushu all state that names, addresses, telephone numbers and credit card numbers were not included, and none has reported passwords among the affected fields.
Members of Otona no Kyujitsu Club are the exception worth noting: their dates of birth and credit card expiry dates were in scope alongside email addresses. An expiry date is not usable on its own, but combined with a name and card number obtained elsewhere it raises the value of a targeted approach. This is the same pattern seen when Weverse reported payment logs but not card numbers earlier this year.
What to Do if You Hold One of These Accounts
The practical risk from an email-address exposure is targeted phishing, and the companies have said they will contact affected customers individually once preparations are complete.
- Expect a notification by email, and treat it carefully: JR East, View Card and JR Kyushu all plan to email affected members directly. Because attackers now know which addresses belong to which service, a fake version of that notice is the obvious next move.
- Do not click links in any email about this incident: open the Eki-net, VIEW’s NET or JR Kyushu site or app yourself and check for notices there.
- Watch for messages that quote real details back at you: a membership number or a card expiry date in an email does not prove the sender is genuine, because those fields were in scope for Otona no Kyujitsu Club members.
- Check card statements if you hold a View Card: card numbers were not in the affected system, but statement review is the cheapest way to catch anything the companies have not yet found.
- Do not act on a phone call about the breach: none of the companies has said it will telephone customers, and the steps that follow a document-level breach are different from those that follow an email-list exposure.
What the Attacker Claims
The group behind the attack has made claims about the damage that IDC Frontier has not confirmed. Reporting on 8 October listed assertions of 225 databases encrypted, 3.6 petabytes of data affected, 239 hypervisors compromised, around 16,000 virtual machine disks touched and 554,153 snapshots deleted. Separate coverage cited a claim of 41.5 petabytes of backups destroyed.
These figures come from the attacker, they differ between reports, and IDC Frontier has not verified any of them. The company has named no ransomware group and has not said whether a ransom was demanded. Several municipal customers have reported being unable to reach their backup data since the outage, and IDC Frontier has said that for some affected virtual servers, retrieving or restoring data is expected to be difficult.
Where Recovery Stands as of 12 October 2026
As of IDC Frontier’s most recent update, timestamped 6:00 p.m. on 11 October 2026, the response to the unauthorized-access failure is still running, with the scope of impact under investigation and recovery work in progress. The company says no new material facts have been disclosed since its previous update and that it will announce any promptly.
IDC Frontier has given no restoration date, no customer-by-customer breakdown and no finding on whether data was exfiltrated. Its four published reports run from 7 to 9 October; the 11 October entry is a status line rather than a fifth report.
Frequently Asked Questions
What Is the IDC Frontier Ransomware Attack?
It is a ransomware attack on IDC Frontier, a SoftBank Corp cloud hosting subsidiary, that disrupted its IDCF Cloud service from about 3:40 a.m. on 7 October 2026. IDC Frontier says 495 companies and local governments were affected.
Was My Data Stolen?
No company has confirmed that data was taken. JR East, View Card, JR Kyushu and Peach Aviation have published the maximum number of records that could be affected and say they cannot rule out that some was viewed or obtained.
Were Credit Card Numbers Exposed?
No. JR East, View Card and JR Kyushu all state that credit card numbers were not included, along with names, addresses and telephone numbers. Card expiry dates were in scope for Otona no Kyujitsu Club members.
Do I Need to Change My Password?
None of the companies has reported passwords among the affected data, and none has asked members to reset them. The exposed information was held in an external email-delivery system rather than in the account databases.
When Will IDCF Cloud Be Restored?
IDC Frontier has not given a date. Its 11 October status update says recovery work is in progress, and it has warned that data on some affected virtual servers may be difficult to retrieve or restore.
