Move to the Cloud and Harden It, and It Is Still Breached

Conclusion

Move to the cloud and harden it, and it is still breached. When it is breached, all that can be restored is the copy the customer kept themselves. The IDCF Cloud incident of October 2026 showed this through the provider's own notice.

What Happened

In the early hours of 7 October 2026, a third party broke into East Japan Region 1 of IDCF Cloud, run by IDC Frontier, and ransomware stopped the whole region. IDC Frontier is a SoftBank subsidiary whose business is running cloud infrastructure.

On top of this cloud sat telephone services, e-commerce inventory systems, the management consoles of security products, and a speech-recognition app. Each of their users was stopped too.

What the Provider's Notice Shows

The notice to customers (seventh report) says the following.

• Recovering the data and virtual machines in the affected environment is extremely difficult
• Restoring from snapshots is also difficult
• Rebuilding in other regions is not recommended until their safety is confirmed
• Data can be restored only from backups the customers hold themselves

The first two show that the copies the provider kept became unusable along with the originals. The third shows that moving to another region could not be called safe. The fourth confirms, at the scene of an incident, what cloud contracts had always stated.

Defense Can Be Handed Over; the Copy Cannot

One reason to move to the cloud was that defense could be handed to a specialist provider. This time, that provider was breached. The provider had nothing to restore from, and the outcome split on whether the customer held a copy.

The entry route and the exact extent of the damage had not been published when this was written. Knowing them will not change this conclusion, because however hard the defense, the possibility of a breach does not go away.

Related

• The Day a Cloud Vanished — Five Lessons from the IDCF Incident — lessons drawn from the same incident
• Growing a Debian Server with Claude, Chapter 10 — Protecting Your Data — keeping a copy on another machine, in another place, under another authority
• Structural Analysis 3-10 — Defense Cannot Be Bought — cases where outsourcing, products, and platforms became the entrance

References

1. ITmedia NEWS, "Unauthorized access to IDCF Cloud; outage in East Japan Region 1" (7 October 2026) — https://www.itmedia.co.jp/news/article/2610/07/2000002087/
2. IDC Frontier, "IDCF Cloud incident notice (7th report)" (October 2026, notice to customers)
3. List of affected services (Security Measures Lab, 7 October 2026) — https://rocket-boys.co.jp/security-measures-lab/idcf-cloud-outage-affected-services-2026/