TOKYO, September 26 — Keio Corporation confirmed a ransomware attack on its business systems early Saturday, disrupting internal operations while train services continued to run normally. The company detected a system failure and later verified the incident as a ransomware intrusion, prompting it to isolate parts of its network to contain the threat. An investigation was launched to assess the scope of the breach, including the potential exposure of confidential business and customer data.
Keio operates approximately 85 km of railway lines and 69 stations, linking western Tokyo with the Tama region and portions of Kanagawa Prefecture. As part of the Keio Group, it also oversees hotels, retail, and other services, employing more than 2,200 individuals across its subsidiaries.
Keio Plaza Hotel, a key subsidiary, reported system difficulties and delayed responses to customer inquiries through its website and reservation platforms. Despite the disruption, the hotel confirmed no information leakage had been verified at the time of the announcement. The attack did not affect train operations, which remained unaffected throughout the incident.
As of the disclosure, no ransomware group had claimed responsibility for the breach. The following day, September 27, Tokyo Metro disclosed a separate security incident involving unauthorized access to the email addresses of roughly 59,000 customers in its Metpo loyalty program.
Tokyo Metro stated it had identified the suspected entry point and implemented preventive measures, noting that no other personal data was accessed but urging customers to stay alert for phishing attempts using the exposed addresses. Both incidents were made public in late September 2026, with Keio’s statement issued in the early hours of September 26 and Tokyo Metro’s announcement released on September 27. The disclosures underscore persistent cybersecurity challenges facing Japan’s transportation sector, particularly ransomware threats targeting operational and customer-facing systems.
As critical infrastructure operators, rail companies like Keio and Tokyo Metro manage vast networks that integrate transit, hospitality, and retail services, expanding their digital attack surface. The events highlight the growing need for resilient cybersecurity frameworks that protect not only core operations but also interconnected service platforms. Looking ahead, industry observers will monitor how Keio advances its investigation, whether further details emerge about data exposure, and what long-term upgrades to its IT resilience are announced.
The incident adds to a broader trend of transportation providers in Asia strengthening defenses against evolving cyber threats, especially as digital services become more deeply embedded in customer experience and internal workflows. For now, the focus remains on containment, transparency, and restoring full system integrity across affected divisions.
