INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Keio Corporation Hit by Ransomware Attack Disrupting Business Systems

| 2026-09-28 20:56 HIGH LOW RANSOMWARE & EXTORTION
JSON
Executive Summary
AI-generated
Keio Corporation, a major Japanese private railway operator based in Tokyo, was hit by a ransomware attack over the weekend, disrupting some of its business systems. The company detected a system failure early Saturday and later confirmed the ransomware attack on September 26, 2026. No other personal information was accessed, but Keio warned customers to be alert for possible phishing emails or other follow-up scams using exposed addresses. This incident highlights the growing threat of cyberattacks in Japan's critical infrastructure sectors, including transportation and hospitality. The company operates approximately 85 km of railway lines and 69 stations, connecting western Tokyo with the Tama area and nearby parts of Kanagawa.
Technical Mitigations AI-generated
• Implementing robust network segmentation to isolate affected systems and prevent lateral movement of the ransomware attack. • Conducting regular security audits and vulnerability assessments to identify potential entry points for future attacks. • Utilizing advanced threat detection tools, such as endpoint protection software and intrusion detection systems, to monitor system activity and detect anomalies in real-time.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
NORTH_AMERICA NORTH_AMERICA healthhealth hospitalityhospitality transportationtransportation
Incident Timeline
‎September 26, 2026
Keio's business systems were disrupted by a ransomware attack affecting only the hospitality side of its operations.
organisation BleepingComputer
At the time of writing, BleepingComputer could not find a ransomware group claiming the attack on Keio.
organisation Keio’s
The incident appears to have affected only the hospitality side of Keio’s business, not train operations.
organisation NFL
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
organisation CHANEL
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
data_breach 59,000 member email addresses
Tokyo Metro has also disclosed a cyber incident  over the weekend in which attackers gained unauthorized access to its systems and accessed 59,000 member email addresses.
‎September 27
Threat actors accessed the email addresses of approximately 59,000 Tokyo Metro customers enrolled in its Metpo loyalty program.
target_region Japan
Another Japanese railway operator, Tokyo Metro, on September 27 announced that an unauthorized third party had accessed the email addresses of about 59,000 customers enrolled in its Metpo loyalty program.
victims 59,000 customers
Another Japanese railway operator, Tokyo Metro, on September 27 announced that an unauthorized third party had accessed the email addresses of about 59,000 customers enrolled in its Metpo loyalty program.
‎2026/09/28
Keio Corporation confirmed a ransomware attack on its group's servers in the early hours of September 26, 2026.
data_breach 26 September
“In the early hours of September 26, 2026, we confirmed a ransomware attack on our group's servers.
“Keio Corporation (hereinafter referred to as “the Company”) confirmed in the early hours of September 26, 2026, that a system failure occurred due to a ransomware attack.”
organisation “Keio Corporation
“Keio Corporation (hereinafter referred to as “the Company”) confirmed in the early hours of September 26, 2026, that a system failure occurred due to a ransomware attack.”
organisation Keio Corporation
Japanese railway operators Keio Corporation and Tokyo Metro disclose security breaches.
organisation Kanagawa
It operates about 85 km of railway lines and 69 stations, connecting western Tokyo with the Tama area and nearby parts of Kanagawa.
victims 2,200 employees
The company has over 2,200 employees and a reported annual revenue of about $2.6 billion.
Keio has more than 2,200 employees.
organisation the Keio Group
The company is part of the Keio Group, which also operates hotels, retail businesses and other services.
organisation Some Keio Group
Some Keio Group companies are experiencing disruptions to their business systems following the cyberattack.
organisation Keio Plaza Hotel Tokyo
reads the notice published by Keio Plaza Hotel Tokyo.
‎September 29, 2026
Ransomware disrupted Keio Corporation's business systems, forcing the company to shut down its network.
tactic Ransomware
Japanese railway operators Keio Corporation and Tokyo Metro disclose security breaches Pierluigi Paganini September 29, 2026 Keio, a major Japanese railway operator, was hit by ransomware, disrupting business systems and forcing the company to shut down its network.
target_region Japan
Japanese railway operators Keio Corporation and Tokyo Metro disclose security breaches Pierluigi Paganini September 29, 2026 Keio, a major Japanese railway operator, was hit by ransomware, disrupting business systems and forcing the company to shut down its network.
Tactical Metrics
Metrics
data_breach
26
September
“In the early hours of September 26, 2026, we confirmed a ransomware attack on our group's servers.
“Keio Corporation (hereinafter referred to as “the Company”) confirmed in the early hours of September 26, 2026, that a system failure occurred due to a ransomware attack.”
Metrics
victims
2,200
Employees
The company has over 2,200 employees and a reported annual revenue of about $2.6 billion.
Keio has more than 2,200 employees.
Metrics
data_breach
59,000
Member Email Addresses
Tokyo Metro has also disclosed a cyber incident  over the weekend in which attackers gained unauthorized access to its systems and accessed 59,000 member email addresses.
Metrics
victims
59,000
Customers
Another Japanese railway operator, Tokyo Metro, on September 27 announced that an unauthorized third party had accessed the email addresses of about 59,000 customers enrolled in its Metpo loyalty program.
Intelligence Sources
BleepingComputer 2026-09-28
Security Affairs 2026-09-29