Ransomware hit IDCF Cloud, the infrastructure service run by IDC Frontier, a SoftBank subsidiary, taking the platform down from around 3:40am on October 7 and affecting 495 companies and local governments by the provider's own count. Virtual servers in several affected zones were stopped and could not be restarted. The instruction given to customers is the part every small business should read twice: build a new environment and restore from your own backups.
What that sentence actually means
It means the provider is telling you the machine is gone and recovery is your job. Not maliciously, and not unusually: that is how the arrangement has always worked. But most small businesses have quietly assumed the opposite. The mental model is that putting something in the cloud outsources the whole problem, including getting it back. What the provider actually guarantees is the infrastructure. What happens to your data inside it, and whether a usable copy exists somewhere else, is the customer's side of the bargain.
The attacker in this case claims to have encrypted 3.6 petabytes of data, which is unverified. The provider has not said how the attackers got in, who they are, or whether data was stolen as well as encrypted, and it kept its management console closed while checking other regions. All normal for the first days of an incident, and all beside the point for a customer who needs to be running again.
Why this is not a far-away story
Swap the names. If your accounting system, file storage, phone system or line-of-business application is hosted by a provider, you are a customer in exactly this position. It does not require your provider to be careless. It requires only that something happens to them, and then the question becomes what you hold independently.
Two specific traps are worth naming. The first is treating a platform's own replication as a backup. Replication copies a problem faithfully, including encryption. The second is believing a cloud suite's built-in retention is enough: Microsoft 365 and Google Workspace both tell you plainly that protecting your data is shared responsibility, which is why backing up Microsoft 365 is a real question and not a paranoid one.
What to actually do
- List your hosted systems and name the copy. For each one, write down where an independent copy of the data lives. If a row is blank, that is your exposure.
- Make one copy that the provider cannot reach. A backup in the same account, with the same credentials, is not separate. Different provider, different credentials, ideally immutable.
- Test a restore, not a backup report. A green status page is a claim. Pull one real file back, and once a year try rebuilding something from scratch.
- Know your rebuild time, roughly. If recovery means recreating an environment and reloading data, how many days is that, and can the business carry it? That number belongs in your continuity plan.
- Read the contract on recovery. Most hosting agreements promise availability and specifically disclaim responsibility for your data. Knowing that now is better than reading it during an outage.
- Keep an offline copy of the essentials. Client contacts, insurance details, your provider's emergency number. If the environment is down, so is the document that explains what to do.
The takeaway
Nothing about this incident required a small business to do anything wrong. The customers affected made an ordinary decision to host with a large, reputable provider, and then one morning the answer to how do we get back was restore from your own backups. The only useful preparation for that sentence is having an honest answer to it today, which takes an afternoon and costs very little.