Two clouds attacked in Japan: lessons for your business

Ransomware crippled servers of 495 organizations on IDCF Cloud, and the attackers behind the Onamae.com Desktop Cloud breach published data after a refused ransom. What these cases teach about backups.

In October 2026, two Japanese clouds suffered serious attacks just days apart. Both cases leave the same lesson: the provider protects its platform, but each business's data and continuity depend on what that business has planned for itself.

IDCF Cloud: ransomware on a SoftBank cloud

On October 7, ransomware crippled the virtual servers in four zones of the East Japan Region 1 of IDCF Cloud, run by IDC Frontier, a SoftBank group company. The attack affected 495 businesses and local governments. The next day, the provider warned that this data could only be restored from each customer's own backups, and asked customers in other regions to back up their information.

Its October 27 report explains that the attackers got in through a vulnerability in open-source software used by the customer portal's authentication system and, from there, obtained administrative rights over the virtualization platform. The provider was able to recover backups for 206 customers, considers it difficult to restore the servers in their original environment and is helping customers migrate to alternative environments. It paid no ransom and had no contact with the attackers, and found no evidence that data was taken from the virtual servers, although it did find unauthorized queries to the registration data (names and email addresses) of up to 71 customers on its portal.

Onamae.com Desktop Cloud: ransom refused

GMO Internet, one of Japan's largest domain registrars, detected a malicious program on October 20 in Onamae.com Desktop Cloud, its virtual server service, and estimated that up to 26,739 customer servers could be affected. On October 21 it received an extortion email demanding about 8 billion yen (about 50 million dollars) and announced it would not give in. On October 27 it asked customers to disconnect their machines from the network, shut them down and unplug them. That same day it confirmed that the attacker had published information claiming to belong to GMO and its customers: the company is verifying it, warned that it may contain false data and asked people not to visit that site. It also asked customers to change the passwords of their trading accounts (MT4 and MT5).

Five lessons from the attacked clouds

Keep at least one copy of your data outside your cloud provider.
Keep a disconnected or immutable copy that an attacker cannot encrypt or delete.
Test the restore: a backup that has never been restored is not a guarantee.
Protect cloud management consoles with two-factor authentication and restricted access.
Decide where you would move your systems if your provider were out of service for weeks.

This is the 3-2-1 backup rule applied to the cloud: three copies, on two different media, with one away from the main site.

October 31 update: the latest from GMO and IDC Frontier

In its October 29 notice, GMO said its reward of up to one million dollars for information about those responsible had already received 270 tips, and that it would hand the most promising leads to the police that same day. IDC Frontier closed its investigation in its October 27 report. We also checked this article against both companies' official notices: we clarified that GMO's figure refers to servers that could be affected and that the information published by the attacker is still being verified.

How we help you

Pronetsys Backup Service makes automatic backups of computers, servers and phones in the cloud, as an extra copy outside your main provider, and we help you confirm that you can restore them. Write to us to review your business's backup strategy.