Japan's Keio confirms ransomware attack disrupted business systems
Keio confirmed a weekend ransomware attack that disrupted hospitality systems but not train operations.
Keio Corporation, a major Japanese private railway operator with about $2.6 billion in annual revenue, confirmed a ransomware attack on group servers in the early hours of September 26, 2026. The company shut down its network, notified police, and is investigating the intrusion path and whether customer or partner data was accessed. Disruption appears limited to hospitality systems, including payment issues and possible delays at Keio Plaza Hotel Tokyo; train operations were unaffected. No ransomware group had claimed the attack. Separately, Tokyo Metro said attackers accessed 59,000 member email addresses and that the weakness used has been closed.
- Ransomware hit Keio group servers early on September 26, 2026.
- Hospitality systems and payments were disrupted; trains kept running.
- Keio reported the incident to police and hired external experts.
- No ransomware gang had publicly claimed responsibility.
- Tokyo Metro separately reported access to 59,000 member emails.
Full article407 words · extracted from bleepingcomputer.com · click to collapse
Keio Corporation (Keio), a major private railway operator in Japan, said its network was hit by a ransomware attack over the weekend, disrupting some of its business systems.
Following a system failure in the early hours of Saturday, the company confirmed the attack and shut down its network to prevent additional damage.
The company said it is investigating the extent of the impact and whether the attackers accessed any customer or business partner information.
Keio is a large Japanese railway operator with 85 km of track and 69 stations, as well as a separate hospitality business of 25 hotels. The company has over 2,200 employees and a reported annual revenue of about $2.6 billion.
“In the early hours of September 26, 2026, we confirmed a ransomware attack on our group's servers. We have reported the incident to the police and are conducting an investigation into the attack's route and damage with the cooperation of external experts,” Keio says.
The incident appears to have affected only the hospitality side of Keio’s business, not train operations.
A separate announcement published on the company’s Keio Plaza Hotel Tokyo website is warning of possible delays on some customer-facing services.
Local media outlets have reported that the cyberattack disrupted the firm's payment systems.
At the time of writing, BleepingComputer could not find a ransomware group claiming the attack on Keio.
BleepingComputer has contacted the company to request more information about the incident, and we will update this post with their response once it reaches us.
Tokyo Metro has also disclosed a cyber incident over the weekend in which attackers gained unauthorized access to its systems and accessed 59,000 member email addresses.
Although both Keio and Tokyo Metro are Japanese railway operators, it is unclear if the organizations were targeted in a coordinated campaign by the same threat actor.
Tokyo Metro is a major transit operator that runs nine subway lines covering 195 km and 180 stations, carrying an average of 7 million passengers daily.
The company said the breached systems contained only email addresses and that it has already identified and closed the security weakness the attackers used in this case.
Build your security blueprint for AI-powered attacks
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.