Keio Corporation (Keio), a major private railway operator in Japan, said its network was hit by a ransomware attack over the weekend that crippled some of its business systems.
After a system failure in the early hours of Saturday, the company confirmed the attack and shut down its network to prevent further damage.
The company said it was investigating the extent of the impact and whether the attackers accessed customer or business partner information.
Keio is a large Japanese railway operator with 85 km of tracks and 69 stations as well as a separate hotel operation with 25 hotels. The company employs over 2,200 people and generates reported annual sales of around $2.6 billion.
“In the early hours of September 26, 2026, we confirmed a ransomware attack on our group’s servers. We reported the incident to the police and are conducting an investigation into the course and damage of the attack in collaboration with external experts.” Keio says.
The incident appeared to have only affected the hospitality side of Keio’s business, not train operations.
A separate announcement was posted on the company’s website Keio Plaza Hotel Tokyo website warns of possible delays in some customer-facing services.
Local media reported on the cyber attack disrupted the company’s payment systems.
At the time of writing, BleepingComputer was unable to find a ransomware group that claimed responsibility for the attack on Keio.
BleepingComputer has contacted the company and asked for more information about the incident. We will update this post with the response as soon as we receive it.
Tokyo Metro also has a cyber incident was disclosed Over the weekend, attackers gained unauthorized access to the company’s systems and accessed the email addresses of 59,000 members.
Although both Keio and Tokyo Metro are Japanese railway operators, it is unclear whether the organizations were targeted as part of a coordinated campaign by the same threat actor.
Tokyo Metro is a major transport operator, operating nine subway lines with a length of 195 km and 180 stations, transporting an average of 1.5 km 7 million passengers daily.
The company said that the attacked systems only contained email addresses and that it had already identified and closed the vulnerability that the attackers exploited in this case.
