Japanese railway operators Keio Corporation and Tokyo Metro disclose security breaches
Keio confirmed a ransomware attack disrupting business systems, while Tokyo Metro exposed about 59,000 loyalty emails.
Keio Corporation, a major private railway operator in Tokyo, confirmed a ransomware attack detected in the early hours of September 26, 2026, that disrupted some business systems. Keio shut down parts of its network; train services are operating normally, and no information leak has been confirmed. Keio Plaza Hotel was also affected and warned of slower responses to inquiries. Separately, Tokyo Metro said an unauthorized party accessed email addresses of about 59,000 Metpo loyalty members and warned customers about possible phishing follow-ups. No ransomware group has claimed the Keio attack.
- Keio confirmed ransomware early on September 26, 2026, after a system failure.
- It shut down network segments; passenger train services continue normally.
- No customer or business data leak is confirmed; investigation continues.
- Keio Plaza Hotel reported system trouble and slower inquiry responses.
- Tokyo Metro said about 59,000 Metpo loyalty email addresses were accessed.
Full article472 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
September 29, 2026
Keio, a major Japanese railway operator, was hit by ransomware, disrupting business systems and forcing the company to shut down its network.
Keio Corporation, one of Japan’s major private railway operators, was hit by a ransomware attack over the weekend, disrupting some of its business systems.
The company detected a system failure early Saturday and later confirmed the ransomware attack. Keio shut down its network to prevent the attackers from causing further damage.
Keio Corporation immediately launched an investigation into the incident to assess the scope of the security breach.
Keio Corporation is a major private railway operator based in Tokyo, Japan. It operates about 85 km of railway lines and 69 stations, connecting western Tokyo with the Tama area and nearby parts of Kanagawa. The company is part of the Keio Group, which also operates hotels, retail businesses and other services. Keio has more than 2,200 employees.
“Keio Corporation (hereinafter referred to as “the Company”) confirmed in the early hours of September 26, 2026, that a system failure occurred due to a ransomware attack.” reads the company’s notice. “We are currently investigating the scope of the impact, including the leakage of confidential information related to our business and customer information.”
Some Keio Group companies are experiencing disruptions to their business systems following the cyberattack. So far, Keio has not found evidence that any information was leaked, but the investigation is still ongoing.
The company immediately shut down parts of its network to prevent further damage and is working to determine the cause and full impact of the incident. Despite the disruption to business systems, train services are currently operating normally. Keio said it will provide further updates as new information becomes available.
Keio Plaza Hotel was also affected by the attack.
“While some of our systems are experiencing difficulties, we have not confirmed any information leakage at this time. We will continue to investigate.” reads the notice published by Keio Plaza Hotel Tokyo. “Currently, it may take longer than usual to receive a response to inquiries made through the contact form on our official website and through various reservation sites. Additionally, depending on the situation, we may not be able to respond to all inquiries.”
At this time, no ransomware group has claimed responsibility for this attack.
Another Japanese railway operator, Tokyo Metro, on September 27 announced that an unauthorized third party had accessed the email addresses of about 59,000 customers enrolled in its Metpo loyalty program. Tokyo Metro said it identified the suspected entry point and took steps to prevent another incident.
No other personal information was accessed, but the company warned customers to be alert for possible phishing emails or other follow-up scams using the exposed addresses.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, newsletter)