Japan’s Keio Confirms Ransomware Attack Disrupted Business Systems

Keio Corporation, a major private railway operator in Japan, says a ransomware attack disrupted some of its business systems over the weekend. The company confirmed the incident after a system failure in the early hours of Saturday and shut down its network to prevent further damage.

Keio said the attack on its group’s servers was confirmed in the early hours of September 26, 2026. It reported the incident to police and is investigating the attack’s route and damage with external experts. The company is also checking the extent of the impact and whether attackers accessed customer or business partner information.

The disruption appears limited to Keio’s hospitality business, rather than train operations. Keio Plaza Hotel Tokyo has warned that some customer-facing services may be delayed. Local media reported that the attack disrupted the company’s payment systems. BleepingComputer said it could not find a ransomware group claiming responsibility at the time of its report.

Keio operates 85 km of track and 69 stations, and has 25 hotels. The company has more than 2,200 employees and reported annual revenue of about $2.6 billion. Separately, Tokyo Metro disclosed a cyber incident over the same weekend in which attackers accessed 59,000 member email addresses. It is unclear whether the two incidents were connected.