# The homepage was the contractor

2026-10-08

Kodaira City's website has been down since just after 8 a.m. on 7 October. Nippon TV says the city blamed ransomware on the contractor's cloud, and that contact-form data may have left. The city would not confirm a named cloud vendor to Sankei. Neighboring outages are not the same incident.

Canonical: https://www.fabiocti.com/notes/the-homepage-was-the-contractor/
Author: Fabio Correia

The page a resident cannot open is not the family register. It is also not three other towns.

Nippon TV, citing Kodaira City, says the official site has been unreadable since just after 8 a.m. on 7 October, with no time given for restoration. The city told the broadcaster that the cloud service used by the contractor who maintains the site was hit with ransomware, that the contractor cut the network to stop the spread, and that a leak is not confirmed. The data that might have left is what people typed into inquiry forms: name, address, phone number. Sankei, later today, says a link to a ransomware attack on IDC Frontier has been suggested, and that Kodaira’s spokesperson would not say whether that link is real. The city is still checking whether anything was taken, and is pointing residents to social media in the meantime.

Sankei’s tour of the rest of Tokyo is a different set of sentences. Mitaka says its automatic translation is down because the contractor reported an IDC cloud failure. The rest of Mitaka’s site still loads. Adachi can open its homepage. Some pages, including a public-relations site, error, and the contractor blamed a data-center fault. Musashino’s search has been slow since this morning. People familiar with that one told Sankei the cause was a mass of data requests, including on the 6th and the 7th.

## What one red banner will be asked to cover

“Tokyo municipalities are under ransomware” is four incidents wearing one headline. Kodaira cannot show its homepage, and the maybe-leak is a contact form. Mitaka lost a translation widget. Adachi lost some subpages to a fault the contractor has not called ransomware. Musashino is a flood of requests. Only the first of those is a city saying ransomware and personal data in the same breath, and even that city has not confirmed the vendor name reporters are using.

If you filed a form on Kodaira’s site, assume the name and phone are in the “possible” pile until the city says the look is finished. Do not assume a My Number record moved because a forum did. If you are briefing the other three, say what each contractor actually said. A homepage that will not load is the fact a resident can check. The cloud behind it is the fact the city has only partly described.