Ransomware at Tokyo rail operator Keio reaches the group's hotel business
Keio Corporation shut down its network after a September 26 ransomware attack that disrupted Keio Group companies, including the Keio Plaza Hotel Tokyo. Trains are running normally while Keio checks whether customer and business data left its network.
The Watch · Security desk
What happened
- SC World, citing Bleeping Computer, reported the attack appears to have mainly hit Keio's hospitality business, including possible disruption to payment systems at the Keio Plaza Hotel Tokyo.
- The hotel warned that replies through its website contact form and reservation sites may take longer than usual, and that it may not be able to answer every inquiry.
- Keio reported the incident to police and is working with external experts on the investigation.
- Tokyo Metro announced on September 27 that an unauthorized third party accessed the email addresses of about 59,000 members of its Metpo loyalty program.
Why it matters
- Who's exposed exposure The attack reached group companies outside the railway, so Keio's exposure has to be counted across its hotel and other group businesses as well as the trains.
- Who has to decide decision Whether Keio has to notify hotel guests and business partners depends on an investigation that has not yet ruled data access in or out.
- Who's exposed exposure Anyone holding the Metpo list can send phishing to confirmed Tokyo Metro customers, and the company has told members to expect it; it says no other personal data was accessed.
- What it limits constraint With no claim and no published link, other Japanese rail operators cannot yet treat Keio and Tokyo Metro as one campaign to hunt against.
Keio is still working out the cause and full impact of the attack [13]. It shut down parts of its network to stop further damage [2]. The company runs about 85 km of railway and 69 stations linking western Tokyo with the Tama area and nearby parts of Kanagawa. Its group also runs hotels, retail and other services, and the parent has more than 2,200 employees [16].
Keio's notice puts customer data inside the investigation. "We are currently investigating the scope of the impact, including the leakage of confidential information related to our business and customer information," the company said [4]. So far it has found no evidence that any information was leaked, and the investigation continues [5]. On the public record, data theft at Keio is unconfirmed.
The hotel used nearly the same words. "While some of our systems are experiencing difficulties, we have not confirmed any information leakage at this time. We will continue to investigate," Keio Plaza Hotel Tokyo said in its notice [6]. No ransomware group has claimed the attack [12].
The Tokyo Metro case is a separate disclosure with a narrower data set. The company said it had identified the suspected entry point and taken steps to prevent a repeat [17]. The reports do not describe that entry point. Tokyo Metro's announcement came one day after Keio detected its attack [19]. SC World reported that it remains unclear whether the two incidents are linked or part of a coordinated campaign [18].
What to watch
- A ransomware group posting Keio on a leak site, or Keio confirming that customer or business-partner data was taken.
- Keio naming the cause and entry point, and saying whether Keio Plaza Hotel Tokyo payment systems were affected.
- Any technical detail tying Tokyo Metro's Metpo intrusion to the Keio attack.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence65
Perspective Coverage
4 publishers- Builder
- Builder 16%
- Operator
- Operator 69%
- Investor
- Investor 15%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Keio Corporation confirmed in the early hours of September 26, 2026 (a Saturday) that a system failure occurred due to a ransomware attack.
- [2]
Keio shut down (parts of) its network to prevent the attackers from causing further damage.
- [3]
Despite the disruption to business systems, Keio train services are operating normally.
- [4]
"We are currently investigating the scope of the impact, including the leakage of confidential information related to our business and customer information."
- [5]
Keio has not found evidence that any information was leaked, but the investigation is still ongoing.
- [6]
"While some of our systems are experiencing difficulties, we have not confirmed any information leakage at this time. We will continue to investigate."
- [7]
Some Keio Group companies are experiencing disruptions to their business systems following the cyberattack.
- [8]
Keio is assessing whether customer or business partner information was accessed.
- [9]
Tokyo Metro announced on September 27 that an unauthorized third party had accessed the email addresses of about 59,000 customers enrolled in its Metpo loyalty program.
- [10]
Tokyo Metro said no other personal information was accessed and warned customers to be alert for possible phishing emails or other follow-up scams using the exposed addresses.
- [11]
Keio Plaza Hotel Tokyo said it may take longer than usual to respond to inquiries made through the contact form on its official website and through various reservation sites, and that depending on the situation it may not be able to respond to all inquiries.
- [12]
No ransomware group has claimed responsibility for the attack on Keio.
- [13]
Keio is working to determine the cause and full impact of the incident.
- [14]
The ransomware attack appears to have primarily affected Keio's hospitality business, including potential disruptions to payment systems at the Keio Plaza Hotel Tokyo.
- [15]
Keio reported the incident to the police and is working with external experts.
- [16]
Keio operates about 85 km of railway lines and 69 stations connecting western Tokyo with the Tama area and nearby parts of Kanagawa; it is part of the Keio Group, which also operates hotels, retail businesses and other services; Keio has more than 2,200 employees.
- [17]
Tokyo Metro said it identified the suspected entry point and took steps to prevent another incident.
- [18]
It remains unclear whether the Keio and Tokyo Metro incidents are linked or part of a coordinated campaign.
- [19]
Tokyo Metro's disclosure came one day after Keio detected its ransomware attack.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
4 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comJapan's Keio confirms ransomware attack disrupted business systems
1 article · September 28, 2026
- infosecurity-magazine.comJapanese Railway Operators Hit with Weekend Cyber Attacks
1 article · September 29, 2026
- scworld.comJapanese railway operator Keio hit by ransomware attack
1 article · September 29, 2026
- securityaffairs.comJapanese railway operators Keio Corporation and Tokyo Metro disclose security breaches
1 article · September 29, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Transport sector cybersecurityFollow
- RansomwareFollow
- Data BreachesFollow