What the October 18 Update Restores
The IDCF Cloud disruption began on October 7, 2026, at 3:40 a.m. Japan time and was disclosed publicly that day. IDC Frontier reports unauthorized access involving ransomware, halted virtual machines across four zones, and effects on 495 businesses and local authorities.
On October 18, the provider announced that backup service had resumed in areas where virtual machines remained operational. According to its notice, customers can create copies and restore them to other clouds or their own infrastructure, while the snapshot function remains suspended. The reopening therefore concerns a service available to environments that are still running. It does not establish that systems halted by the incident have recovered.
Recovery Must Be Verified for Each Customer
On October 14, IDCF had already stated that snapshot backups could be extracted for 194 affected customers. Extracting a copy is a necessary step, but the feasibility of recovery still had to be assessed individually. Data, configurations, and application dependencies must be brought together in a functioning environment.
On confidentiality, IDCF reports finding no traces of data exfiltration from the affected virtual machines and concludes that none occurred. This is the provider’s assessment. It is separate from the confirmed unauthorized viewing of portal records relating to 48 customers.
Effects on Customer Services
Six Apart reports 31 affected servers and the preparation of alternative environments. It also describes operational limitations and migrations requiring changes to IP addresses and system characteristics. Peach reported delays in booking-related emails while stating that flights were unaffected. These are different consequences that need to be assessed through the applications and activities actually involved.
The incident concerns infrastructure shared by businesses and local governments. For organizations that depend on an external cloud, the practical question is whether they can continue elsewhere and under what constraints. The sources reviewed do not establish a global impact or a geopolitical motive, and the attacker remains unidentified.
Testing the Ability to Resume Operations
If extracting backups and rebuilding environments proceeds slowly, limitations on customer applications may persist. Successful migrations and usable backups could instead support a gradual recovery. Assessing progress requires confirmation for individual services, evidence of when functions return, and checks on data integrity.
For an organization with comparable dependencies, the most useful test is to recover a priority service in a separate environment. The IT lead should measure the time and difficulties involved, including configurations and dependencies. In parallel, business continuity staff should agree on recovery priorities with application owners and establish the alternative channels needed to maintain essential functions.
Sources and Supporting Evidence
- IDCF Cloud — Sixth notice on resumption of backup service
- IDCF Cloud — Fifth notice on the investigation and recovery options
- IDCF Cloud — Third notice on the scope of the ransomware disruption
- Movable Type Cloud — Fourth update on the IDCF incident
- Peach Aviation — Unauthorized access at an external cloud provider and personal data status
- IDCF Cloud — Initial notice of unauthorized access
- Tokyo skyline, January 17, 2015
This analysis reflects the sources available as of the date shown. Facts, attribution, and potential consequences may require reassessment as new evidence emerges.