Ransomware takes down IDC Frontier's cloud (SoftBank): 495 Japanese organisations hit — a backup lesson for Vietnamese businesses

In the early hours of 7 October 2026, IDCF Cloud — the cloud platform of IDC Frontier, a subsidiary of SoftBank Corp. in Japan — was hit by ransomware. According to IDC Frontier's own notices, 495 businesses and local governments using the affected region lost their virtual servers, and the provider stated that the data would be "difficult to retrieve or restore" — recoverable only from backups the customers kept themselves. The lesson for Vietnamese businesses is clear: renting cloud capacity does not mean you have a backup. If your only backup sits with the same provider, an incident like this can take both your systems and your data.

What happened to IDCF Cloud?

This was a ransomware attack aimed directly at a cloud provider's infrastructure, not at individual customers. According to IDC Frontier's first report, the incident began "at around 3:40 a.m. on Wednesday, 7 October 2026", the scope was "East Japan Region 1", and the initial cause was "unauthorised access by a third party". The same day, the 2nd report confirmed it was a ransomware attack and said the company had disconnected the region from the network and shut the systems down "to prevent the spread of damage and data leakage".

IDC Frontier provides cloud infrastructure (IaaS) to Japanese businesses and public bodies. The 4th report says the company set up an emergency task force at 9 a.m. on 7 October and worked closely with its parent company, SoftBank Corp. Some international outlets wrongly named the parent as "SoftBank Group"; the official notices say SoftBank Corp.

How bad is the damage?

The main damage is to customers' servers and data in the attacked region. The 3rd report named 4 availability zones (tesla, henry, pascal, joule): virtual servers were stopped and could not be restarted, and customer data stored there "is expected to be difficult to retrieve or restore". The most important line in that notice: in the company's assessment at the time, data could only be restored from backups held by the customers themselves, and the company was guiding customers to prepare another environment to rebuild their systems. Other IDCF Cloud regions showed no sign of unauthorised access, but customers were still advised to back up their own data.

A week later, the picture was partly less grim. The 5th report said there was no trace of data inside virtual machines being viewed or taken out, and that 194 of the 495 customers — those who had enabled the snapshot feature — recovered their backup data, although whether each restore succeeds is still being discussed with customers individually. The same report confirmed that the registration details of 48 companies on the IDCF Cloud management portal were queried without authorisation; passwords were stored as hashes.

The damage spread to customers' customers. JR East warned that about 1.67 million Ekinet members and about 390,000 Otona no Kyujitsu Club members might have had their information exposed because its email delivery provider used IDCF Cloud; on 15 October, JR East said it had received a report that no personal information had been leaked, according to ScanNetSecurity.

The shocking numbers need careful reading. SDxCentral quotes the attacker's message boasting: "Exactly seven minutes is what it took to turn your entire East Japan Region one into ciphertext (and) take a national cloud apart". BleepingComputer, citing a screenshot of the same message, reports: "The threat actor claims they encrypted 225 databases corresponding to 3.6 PB of data, reached 239 hypervisors, sealed 16,000 VM disks, and wiped 554,153 snapshots." BleepingComputer says "225 databases", while SDxCentral says 225 data stores. All of these are claims; so far no group has been named and IDC Frontier has not disclosed the entry point.

The biggest lesson: backups must be separate from the provider

The central lesson is this: a backup that sits with the same provider, on the same infrastructure, can be lost at the same moment as the main system. IDC Frontier said plainly that data could only be restored from backups customers kept themselves; customers with copies elsewhere were the ones in control of their own rebuild. Snapshots on the attacked platform itself helped 194 customers, but as of 18 October the feature was still suspended for safety checks — meaning customers were entirely dependent on the provider's timeline.

The industry is fairly aligned on the remedy, and Vietnam is writing it into standards. The draft national standard for cloud platforms serving critical digital infrastructure, published for comment by the Ministry of Public Security, requires that backups "must be stored in immutable write mode", and that no account — "including the highest-privileged account" — may delete, modify or overwrite a backup during its retention period. The draft also requires malware scanning before restore, clear disclosure of the maximum tolerable data loss (RPO) and maximum recovery time (RTO), and that the system must be able to keep operating "even in the event of losing access to the platform software provider". It is still a draft without an official number, but it shows where the regulator is heading.

For businesses, the practical principle boils down to this: at least one copy somewhere separate from your main provider (a different provider, on-premises, or offline), a copy that cannot be deleted with an ordinary admin account, and real restore drills — not just "backup is switched on".

Which rules apply in Vietnam?

For cloud serving e-Government, a requirements framework has existed since 2025. Decision 8297/QĐ-BCA-A05 of 9 October 2025 by the Ministry of Public Security issues a set of cybersecurity criteria for cloud computing platforms serving e-Government/e-local government. It is mandatory for state agencies and businesses providing cloud to e-Government; other organisations are encouraged to use it as a reference.

One detail needs updating: Decision 8297 refers to TCVN 14423:2025, but on 24 July 2026, Quyết định 3243/QĐ-BKHCN (Decision 3243 of the Ministry of Science and Technology) published TCVN 14423:2026 "Cybersecurity – Information systems – Basic requirements" and repealed the 2025 version. We have not seen any amendment to Decision 8297 pointing to the new version.

At the statutory level, Luật An ninh mạng số 116/2025/QH15 (Cybersecurity Law No. 116/2025) (effective 1 July 2026) requires organisations to prepare a cybersecurity emergency response plan, to activate that plan immediately when an incident occurs, and to report to the specialised authorities. The law and Nghị định 333/2026/NĐ-CP (Decree 333/2026) also require domestic businesses to store certain types of user data in Vietnam — but that is a rule about storage location, not an obligation to back up or recover from disasters. Businesses should not read "our data is in the country" as "our data is safe".

What should Vietnamese businesses do now?

The first step is to answer one simple question: if your cloud provider went down tomorrow morning and never returned your data, where would you rebuild your systems from, and how long would it take? If the answer is "from a backup that also lives with that provider", you are in exactly the position many IDC Frontier customers were in on 7 October.

Namtech perspective: concentration risk and internal AI

The IDC Frontier case shows concentration risk at work: one provider's incident drags down hundreds of organisations, then spreads to millions of their users. Cloud remains a sensible choice for many workloads, but businesses need to know exactly which parts of their operations depend on whom, and prepare a way out.

This is also why Namtech deploys internal AI on machines located right in the customer's office: data and models stay under the business's control, without depending on an external cloud platform. But on-premises does not mean immune — on-premises systems also need separate, undeletable backups and restore drills like any other system. Namtech builds backup and recovery into the design from the start of every deployment.

The ransomware attack on IDC Frontier's IDCF Cloud on 7 October 2026 left 495 Japanese businesses and local governments without their servers, and the provider confirmed that data could only be restored from backups customers kept themselves — proof that businesses need backups that are separate from their cloud provider, cannot be deleted, and have been tested in restore drills.

Frequently asked questions

Note: This article is compiled from public sources checked on 22 October 2026, mainly IDC Frontier's official notices (in Japanese, translated by us). The situation is still developing and details may change. Figures claimed by the attacker are clearly marked as unconfirmed. The times in Table 4 are Namtech's estimates, not figures from the sources. The legal section is for reference only and does not replace legal advice.