Ransomware strikes Japan's Keio railway operator, disrupts hospitality systems

A ransomware intrusion has compromised Keio Corporation, one of Japan's largest private railway operators, disrupting portions of its business infrastructure. The attack surfaced early Saturday morning when system failures alerted the company to the breach. To limit further damage, Keio immediately took its network offline and began damage assessment efforts.

Keio operates 85 kilometers of railway track across 69 stations and runs a hospitality division encompassing 25 hotels. The organization employs more than 2,200 people and generates roughly $2.6 billion in annual revenue. The company is now working to determine what data, if any, the attackers obtained from customer and business partner systems.

In a statement, the company disclosed: "In the early hours of September 26, 2026, we confirmed a ransomware attack on our group's servers. We have reported the incident to the police and are conducting an investigation into the attack's route and damage with the cooperation of external experts." The intrusion appears limited to the hospitality business segment, leaving train operations unaffected.

The hospitality division has warned of potential service disruptions for customers, and reporting from local media indicates that payment processing systems sustained damage in the attack. As of the time of reporting, no ransomware group had publicly claimed responsibility for the incident.

The Keio incident arrives alongside a separate cyber breach at Tokyo Metro, another major Japanese transit operator. Over the same weekend, attackers gained unauthorized access to Tokyo Metro's infrastructure and extracted 59,000 member email addresses. The company confirmed that the compromised systems held only email addresses and that it has since patched the vulnerability the attackers exploited.

Tokyo Metro operates nine subway lines spanning 195 kilometers with 180 stations and serves approximately 7 million passengers daily. Whether the two incidents represent coordinated activity by a single threat actor or separate attacks remains unclear at this stage.