# The region did not come back

2026-10-09

IDC Frontier says ransomware hit IDCF Cloud at 3:40 a.m. on 7 October, in East Japan Region 1. 495 companies and municipalities are affected, and some virtual servers may not be restorable from the provider. JR East's 6.09 million is emails, not card numbers, and not the trains.

Canonical: https://www.fabiocti.com/notes/the-region-did-not-come-back/
Author: Fabio Correia

Yesterday a city spokesperson would not say whether the dead homepage was this cloud. Today the cloud named itself.

IDC Frontier says unauthorized access to part of IDCF Cloud began around 3:40 a.m. on 7 October, in East Japan Region 1, at the Shirakawa data center in Fukushima. The company calls it ransomware by a third party. It has not named the group. ITmedia, citing the company, says 495 companies and local governments are in the outage, and that for some of the virtual servers data may be difficult to extract or restore. Cybernews describes an update in which four zones were damaged badly enough that customers would have to rebuild elsewhere and restore from their own backups. No leak-site post and no demand have been pinned to a name.

One customer then counted its own file. JR East and View Card say up to about 6.09 million records may have been reached through email delivery that sat on this cloud. ITmedia’s split: about 4.03 million View’s NET email addresses, about 1.67 million Ekinet addresses and not the business service, and about 390,000 members of the senior travel club, where the possible fields add a member number, a card expiry date, and a date of birth. Both companies say names, street addresses, phone numbers, and card numbers were not in it. Member email is partly broken. The Shinkansen is not the sentence they gave.

## What 495 will be asked to mean

It is a customer count, not a row count. Kodaira’s missing homepage, a police portal, a logistics desk, and a railway’s mail tool can all be in it and still be different losses. “The trains were hit” is how a region outage gets briefed. The railway’s own notice is a mailing list, plus expiry dates and birthdays on the senior club. A card number is the field they took pains to exclude. Do not put it back.

If you are one of the 495, the question is whether your copy still exists anywhere that is not East Japan Region 1. The provider has already said some of those machines may not come back from their side. Your backup is the plan. Their snapshot, if it was on the same region, is not a plan.

The homepage note from yesterday was one tenant that would not name the landlord. The landlord spoke today. The file, where a tenant has actually described it, is smaller than the outage.