Cybersecurity
Keio confirms ransomware attack on its servers
Keio Corporation said a ransomware attack on its servers disrupted some business systems, led it to shut down its network, and prompted separate disclosures about hotel services and a different transit breach.
- Keio Corporation said it confirmed a ransomware attack on its group servers in the early hours of 26 September 2026.
- The company shut down its network, reported the incident to police, and said it was investigating the attack route and damage with external experts.
- Keio said it was still checking whether attackers accessed customer or business partner information, and the incident appeared to affect only its hospitality business.
- Tokyo Metro separately said attackers accessed its systems and took 59,000 member email addresses.
- The article said it was unclear whether the two railway operators had been targeted in the same campaign.
Keio Corporation said a ransomware attack hit its servers in the early hours of 26 September 2026, after a system failure was detected on Saturday. It shut down its network to prevent further damage.
The company said it was still examining how far the incident reached and whether customer or business partner information had been taken. Keio said it had reported the case to police and was working with external specialists on the attack route and damage.
The incident appeared to have affected the hospitality side of Keio's business rather than train operations. A separate notice on the Keio Plaza Hotel Tokyo website warned of delays to some customer-facing services, and local media reported disruption to payment systems.
Tokyo Metro separately disclosed a cyber incident over the weekend in which an intruder gained access to its systems and took 59,000 member email addresses. The article said it was not clear whether the two railway operators had been targeted in the same campaign.
Named in this story
Companies
- Keio Corporation
- said its servers were hit by ransomware and shut down its network
- Tokyo Metro
- disclosed a separate cyber incident and said 59,000 member email addresses were accessed
Places
- Keio Plaza Hotel Tokyo
- its website warned of delays to some customer-facing services
How the source tells it
The piece was written as plain incident reporting, with company statements and no sustained emotive framing.
No emotive framing was found in the original.