Japan's Keio confirms ransomware attack disrupted business systems
Keio Corporation, Japan's major railway operator, hit by ransomware attack disrupting hospitality business systems.
Summary
Keio Corporation, a major Japanese railway operator with 85 km of track and 69 stations plus 25 hotels, confirmed a ransomware attack on September 26, 2026 that disrupted business systems, particularly affecting the hospitality division's payment systems. The company reported the incident to police and engaged external experts to investigate the attack's route and scope, including whether customer or business partner data was accessed. A separate cyber incident at Tokyo Metro over the same weekend saw unauthorized access to systems and 59,000 member email addresses, though it remains unclear if both attacks were part of a coordinated campaign.
Full text
Japan's Keio confirms ransomware attack disrupted business systems By Bill Toulas September 28, 2026 04:56 PM 0 Keio Corporation (Keio), a major private railway operator in Japan, said its network was hit by a ransomware attack over the weekend, disrupting some of its business systems. Following a system failure in the early hours of Saturday, the company confirmed the attack and shut down its network to prevent additional damage. The company said it is investigating the extent of the impact and whether the attackers accessed any customer or business partner information. Keio is a large Japanese railway operator with 85 km of track and 69 stations, as well as a separate hospitality business of 25 hotels. The company has over 2,200 employees and a reported annual revenue of about $2.6 billion. “In the early hours of September 26, 2026, we confirmed a ransomware attack on our group's servers. We have reported the incident to the police and are conducting an investigation into the attack's route and damage with the cooperation of external experts,” Keio says. The incident appears to have affected only the hospitality side of Keio’s business, not train operations. A separate announcement published on the company’s Keio Plaza Hotel Tokyo website is warning of possible delays on some customer-facing services. Local media outlets have reported that the cyberattack disrupted the firm's payment systems. At the time of writing, BleepingComputer could not find a ransomware group claiming the attack on Keio. BleepingComputer has contacted the company to request more information about the incident, and we will update this post with their response once it reaches us. Tokyo Metro has also disclosed a cyber incident over the weekend in which attackers gained unauthorized access to its systems and accessed 59,000 member email addresses. Although both Keio and Tokyo Metro are Japanese railway operators, it is unclear if the organizations were targeted in a coordinated campaign by the same threat actor. Tokyo Metro is a major transit operator that runs nine subway lines covering 195 km and 180 stations, carrying an average of 7 million passengers daily. The company said the breached systems contained only email addresses and that it has already identified and closed the security weakness the attackers used in this case. Build your security blueprint for AI-powered attacks Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed. Save your seat Related Articles: Times Car confirms data breach affecting 6.6 million user accountsJadePuffer agentic AI attacks target Azure, destroy cloud resourcesShinyHunters hacked Clop leak site using Grav CMS path traversal flawShinyHunters hacks Clop leak site, threatens to extort ransomware gangCISA: Ransomware gangs now exploiting critical TeamCity flaw