Short answer
IDC Frontier said a ransomware attack on part of its IDCF Cloud began on 7 October 2026. On 27 October it said the attacker gained administrator rights through the portal's authentication system, where a flaw in an open-source component is suspected, and encrypted virtual servers of 495 companies and local governments.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | IDC Frontier (IDCF Cloud) |
|---|---|
| Incident type | Ransomware |
| Status | Confirmed by the organization |
| Sector | Cloud hosting |
| Country | Japan |
| Detected | 2026-10-07 |
| Disclosed | 2026-10-07 |
| People or records affected | Virtual servers of 495 companies and local governments encrypted. Portal registration data of up to 71 companies may have been viewed. |
What data was exposed
- No leak of data on customers' virtual servers has been confirmed
- Cloud portal registration information of up to 71 companies may have been viewed, including personal data such as email addresses for up to 31 companies
- Passwords of up to four portal login accounts were illegally changed
What happened
A service outage on IDCF Cloud began around 3:40 a.m. on 7 October 2026, and Impress Watch reported on 8 October that IDC Frontier had identified it as a ransomware attack. The company confirmed that the East Japan Region 1 was hit, and said 495 companies and local governments were affected. It cut that region off from the network and shut down its systems to prevent secondary damage and data leaks.
The cause, as IDCF explains it
On 27 October IDCF published its findings. According to @IT, a weakness in an open-source component of the portal’s authentication system is suspected as the way in. The attacker reached that system, then used it to gain administrator rights over the virtual infrastructure management console. From there it stopped and encrypted virtual servers of the 495 customers, and the service could not be restarted. @IT says the specific software has not been confirmed, and that speculation online about a particular product is not established.
What data was reached
IDCF has not confirmed that data on the virtual servers was taken out, and no related leaks have been confirmed. In the cloud portal, registration information of up to 71 companies may have been viewed, including personal data such as email addresses for up to 31 companies. Passwords for up to four portal login accounts were illegally changed, and IDCF reset them and contacted those customers.
Customer impact and recovery
Six Apart said 31 servers running its Movable Type cloud version were affected, with admin screens and sites down. On 8 October it said recovery on IDCF Cloud was not expected and it was moving to another provider from backups. Greenwich reported that parts of its inventory and price-update services stopped. Ride On Express, which runs the Ginno Sara and Kamatora delivery brands, tied its own October incident to the attack. We cover that in a separate post.
IDCF restarted its backup service on 18 October. By 20 October, about 206 of the 495 customers had been restored where recoverable backups existed. It is helping others migrate to other providers.
What IDCF says it will change
IDCF has set up a recurrence-prevention team with outside security experts. Planned steps include regular vulnerability checks and patching, central management of software components with an SBOM, and rebuilding portal authentication around a new identity provider with IP restrictions and multi-factor authentication.
What to watch for
When a hosting provider fails, the customers’ customers are the ones who get scam messages. Fake “service migration” or “re-login” emails are common after outages. Our guides on phishing messages and what to do after a data breach explain how to check a message before acting. See also our editorial policy.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Emails posing as IDCF or as a hosted service you use, asking you to log in again or reset a password through a link
- Phishing sent to customers of affected companies, claiming their service is moving provider and needs account details
- Messages to portal contacts that quote real company or contact names to look authentic
What to do if you are affected
- 01If you use a service hosted on IDCF Cloud, take notices only from the provider's official site or app, not from links in emails.
- 02Companies on IDCF should change portal passwords, turn on multi-factor authentication where offered, and review any API keys or credentials stored on affected servers.
- 03If your provider says your data may be involved, treat unexpected emails, calls and texts that mention the provider as suspect.
- 04Use a unique password for each service so a leak at one host cannot unlock another.
- 05Watch for follow-up notices from providers you use and verify them through official channels.
Frequently asked questions
How many customers were affected by the IDCF Cloud attack?
IDC Frontier says 495 companies and local governments were affected. Their virtual servers were stopped and encrypted.
Was customer data stolen?
IDCF has not confirmed that data on the virtual servers was taken out, and no related leaks have been confirmed. Registration data of up to 71 companies in its cloud portal may have been viewed.
How did the attacker get in?
IDCF suspects a weakness in an open-source component of the portal's authentication system, which would have let the attacker gain administrator rights. @IT says the specific software has not been confirmed.
Is the service back?
In stages. @IT reports about 206 of the 495 customers had been restored by 20 October, where backups allowed. Some data could not be recovered, and IDCF is helping customers move to other providers.
Which companies were hit as a result?
Impress Watch names Six Apart, whose Movable Type cloud service had 31 servers affected, and Greenwich, whose inventory and price-update tools stopped. Our separate post covers Ride On Express, which linked its own incident to the attack.
Sources
This post summarises public reporting as of 2026-11-05. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.