Japanese railway operator Keio hit by ransomware attack

Japanese railway operator Keio Corporation confirmed it was the victim of a ransomware attack over the weekend, which disrupted some of its business systems. The company shut down its network to prevent further damage and is investigating the extent of the breach, according to Bleeping Computer.

The ransomware attack, which occurred in the early hours of Saturday, September 26, 2026, appears to have primarily affected Keio's hospitality business, including potential disruptions to payment systems at the Keio Plaza Hotel Tokyo. While train operations were not directly impacted, the company is assessing whether customer or business partner information was accessed.

Keio, a major private railway operator with extensive track and station networks, along with a significant hospitality division, reported the incident to the police and is working with external experts. Separately, Tokyo Metro disclosed a cyber incident where attackers accessed email addresses of approximately 59,000 members. It remains unclear if these two incidents are linked or part of a coordinated campaign. No ransomware group has yet claimed responsibility for the attack on Keio.

Source: Bleeping Computer