A provider’s backup feature lives inside the provider. The failure that takes your servers can reach it too.
What happened
At about 03:40 on 7 October 2026, a third party gained unauthorized access to parts of IDC Frontier’s IDCF Cloud and deployed ransomware. Virtual servers in four zones of East Japan Region 1 (tesla, henry, pascal and joule) stopped and could not be restarted. IDC Frontier said 495 companies and local governments were affected.
On 8 October, in its third report, the provider said data stored in those four zones was expected to be difficult to retrieve or restore. In its words, data could be restored only from backups the customers held themselves, and affected customers were advised to rebuild in a separate environment.
On 14 October, the fifth report found no evidence that customer data had been taken from the virtual servers. It also said that 194 of the 495 customers had used the snapshot feature and that their backup data could be extracted; whether it could be restored was still being discussed with each customer. The remaining 301 depended on copies they held elsewhere. Registration data for 48 customers was improperly queried through the management portal.
On 18 October, the sixth report said the separate backup service had resumed, with restore to other clouds or on-premises systems, while the snapshot function stayed suspended pending safety checks.
The boundary
The incident did not reach the whole provider. IDC Frontier reported no unauthorized access in its radian and newton zones, East Japan Regions 2 and 3 or West Japan Region 1, and said IDCF Cloud Type S and its private cloud were excluded. It has not said how the attackers gained access or who they are, and its no-leak finding is stated as its current assessment.
Attackers’ claims about the number of destroyed snapshots appeared in coverage of the incident; the provider has not confirmed them and this page does not rely on them. The restoration timeline for the stopped servers had not been given as of 18 October 2026.
The point
A copy is only a backup if a failure of the system it protects cannot reach it. Keep one restorable copy outside the provider’s control, and restore from it before the day you need to.
Sources
- IDC Frontier, third report, 8 October 2026: affected zones and data restoration
- IDC Frontier, fifth report, 14 October 2026: no data leak found, snapshots for 194 customers
- IDC Frontier, sixth report, 18 October 2026: backup service resumed, snapshots suspended
More incident dossiers
- Your spare zone needs room for your failure — Google Cloud
- Two gateways. One shared way to fail. — Microsoft Azure
- One failed AI request became 48 more — Microsoft Azure
- One suspended account cut off three clouds — Google Cloud / Railway
- Multi-AZ did not survive the region — AWS
- Cloudflare went down, too — Cloudflare
- Azure’s global front door closed — Microsoft Azure
- One empty DNS record reached across AWS — AWS
All cloud outage evidence → · Test your cloud exit readiness →