Keio Corporation, a major Japanese private railway and hospitality operator, confirmed a ransomware attack on September 26, 2026, that disrupted business systems across its hospitality division. The company initiated a network shutdown to prevent further damage after discovering the intrusion in the early hours of Saturday.
The ransomware attack impacted payment systems and resulted in potential delays for customer-facing services at the Keio Plaza Hotel Tokyo. While the company operates 85 km of railway track and 69 stations, it stated that train operations were not affected by the incident.
Investigation and Response
Following the discovery of the attack on its group servers, Keio reported the incident to the police. The company is currently working with external experts to investigate the attack’s route and the extent of the damage. In a statement, the company noted: In the early hours of September 26, 2026, we confirmed a ransomware attack on our group’s servers. We have reported the incident to the police and are conducting an investigation into the attack’s route and damage with the cooperation of external experts.
At this time, Keio is still assessing whether the attackers accessed any information belonging to customers or business partners. No ransomware group has publicly claimed responsibility for the attack.
Distinction from Other Cyber Incidents
The incident at Keio occurred during the same weekend as a separate cyber event at Tokyo Metro. In that instance, attackers gained unauthorized access to systems and compromised 59,000 member email addresses. While both organizations are Japanese railway operators, reports indicate there is no confirmed link between the two events, and it remains unclear if they were part of a coordinated campaign.
