Japanese Railway Operators Hit with Weekend Cyber Attacks
Tokyo Metro, Keio, and Times Car disclosed cyberattacks, including ransomware and a breach of up to 6.6 million people.
Tokyo Metro said an unauthorized party accessed email addresses of 59,000 Metpo loyalty members and has closed the suspected access point. Keio Corporation reported a September 26 ransomware attack that disrupted some group sales systems, including Keio Plaza Hotel, while railway operations continued and no data leak is confirmed. Separately, Times Car said a same-day website intrusion may have exposed personal data on as many as 6.6 million current and former members, including driver's license and identity documents. Passwords were stored in a non-recoverable form, and no link between the incidents is confirmed.
- Tokyo Metro said attackers accessed 59,000 Metpo loyalty email addresses.
- Keio reported a September 26 ransomware attack; trains kept running.
- Keio cut internet access; sales systems and Keio Plaza Hotel were disrupted.
- Times Car said a website intrusion may affect up to 6.6 million people.
- Exposed Times Car data includes licenses, identity documents, names, and contacts.
Full article495 words · extracted from infosecurity-magazine.com · click to collapse
Two major railway operators in the Tokyo region of Japan have disclosed significant cyber-attacks, although passenger travel remains unaffected.
Tokyo Metro operates some of the capital’s busiest subway lines, carrying over seven million passengers each day.
It said in a statement on September 27 that an unauthorized third party had accessed the email addresses of 59,000 passengers signed up to its Metpo loyalty scheme.
The operator confirmed that it has identified the suspected point of unauthorized access and taken measures to prevent a reoccurrence. Only email addresses were taken, but the company urged customers to “exercise particular caution” regarding possible follow-on phishing attempts.
Read more on threats to railway operators: Ukraine Railway Systems Hit by Targeted Cyber-Attack
The second operator affected, Keio, serves a popular line connecting central Tokyo to suburbs and outlying areas west of the city.
Keio Corporation revealed that a ransomware attack struck on September 26 and that police are currently investigating its extent, “including whether any confidential business information or customer data has been leaked.”
However, the operator appears to have acted swiftly to contain the threat, disconnecting systems from the internet.
“Disruptions have occurred in the sales systems of certain group companies,” it explained. “While we have not confirmed any data leakage at this time, we are continuing our investigation. Please note that there is currently no impact on railway operations.”
The company’s Keio Plaza Hotel was one of the businesses affected.
“Currently, it may take longer than usual to receive a response to inquiries made through the contact form on our official website and through various reservation sites,” it said in a note. “Additionally, depending on the situation, we may not be able to respond to all inquiries.”
Times Car Breach Impacts Millions
It’s unclear whether the Tokyo Metro and Keio security breaches are connected. However, they come at the same time as a third incident impacting a Japanese transport operator.
Car-rental company Times Car announced on September 25 that an unauthorized third party gained access to its website the same day, leading to the compromise of personal information on members and former members.
Exposed information includes names, home and email addresses, dates of birth, membership numbers, driver's license information, identity verification documents, and more.
“Possible leaks of personal information may be misused in phishing emails and other fraudulent activities. Please be cautious of suspicious emails, phone calls, SMS messages, etc., that impersonate our company,” a notice warned.
“Do not open links or attachments in communications you do not recognize, nor enter personal information such as passwords, authentication information, or credit card information. We will never ask for your password or credit card information via email, SMS , or phone.”
The firm said as many as 6.6 million individuals may be impacted. They include current and former members, including Times Business Service members.
Times Car added: “Passwords are stored in a format that cannot be recovered, and there is no risk of customer accounts being misused using this information.”