Keio Corporation, a private railway and hospitality group in Japan, said it confirmed a ransomware attack on its group servers in the early hours of 26 September 2026. BleepingComputer reported the company's statement on 28 September. The company shut down its network after it saw a system failure, and it reported the incident to the police.
This post separates what Keio has said itself from what the press has reported, and lists what nobody outside the company can know yet.
What happened
Confirmed by the company, as quoted by BleepingComputer:
- Keio noticed a system failure in the early hours of Saturday 26 September 2026 and then confirmed a ransomware attack on its group servers.
- It shut down its network to prevent further damage.
- It reported the incident to the police and is investigating the attack route and damage with external experts.
- It is still working out how far the impact goes and whether customer or business partner information was accessed.
Reported by the press, not in the company's own words:
- The incident appears to affect only the hospitality business, not train operations. Keio Plaza Hotel Tokyo warned of possible delays in some customer facing services.
- Local media reported that payment systems were disrupted.
- BleepingComputer said it could not find a ransomware group claiming the attack at the time of writing.
Company background figures in the same article (as attributed there): about 85 km of track, 69 stations, 25 hotels, more than 2,200 employees and annual revenue of about 2.6 billion dollars.
Tokyo Metro disclosed a separate cyber incident the same weekend. Per the article, attackers accessed 59,000 member email addresses, and Tokyo Metro said the affected systems held only email addresses and that it closed the weakness used. The article says it is unclear whether the two incidents are linked, so treat them as unrelated until an investigation says otherwise.
What is still unknown
- The initial access method and the ransomware family.
- Whether data was copied out before encryption, and whether any extortion demand exists.
- How long recovery will take for payment and reservation systems.
- Whether any group will claim the attack on a leak site.
Why it matters
Keio is a useful reminder that ransomware does not need to touch the core product to hurt. Trains kept running. What reportedly broke were the systems that take money and manage guests. For a business with many units, the weakest link is often the shared network and the group servers behind it.
The response is also worth studying. Keio shut down its network within hours, called the police and brought in outside experts. That costs revenue immediately, and it limits the spread.
What to do now
- Find which of your systems take payments or bookings and ask how they would run for a week without the network.
- Test one restore from backup this month, and time it. Keep one backup copy offline or immutable.
- Write down who can order a network shutdown, and how they reach each other if email is down.
- Segment business units so one flat network does not connect hotels, offices and servers.
- Check that remote access and admin accounts use MFA, and review who has domain admin rights.
How this could have been avoided
The initial access is not public, so no one can say what would have stopped this exact attack. These controls address how ransomware of this kind generally spreads and bites, and they are where to look first:
- Network segmentation between business units, so a compromise in one area cannot reach group servers.
- Offline or immutable backups with a tested restore order for payment and reservation systems.
- Manual fallback procedures for card payments and check in, rehearsed before an incident.
- Phishing resistant MFA on remote access and privileged accounts.
- An asset inventory, so the team knows what sits on the group servers when they go dark.
Click through it at your own pace, or open it full screen.
Quick check
Which facts in this story come from Keio itself?
That it confirmed a ransomware attack on group servers on 26 September 2026, shut down its network, informed the police and is investigating with outside experts. The hotel focus and the payment disruption come from press reports.
Is the Tokyo Metro incident part of the same attack?
Unknown. BleepingComputer said it is unclear whether the two were coordinated.
