Japan's Keio confirms ransomware attack disrupted business systems

Japanese railway operator Keio said a ransomware attack hit its group servers early on September 26, 2026, disrupting some business systems while train operations were unaffected. The company reported the incident to police and is investigating whether customer or partner data was accessed.

• Attack affected Keio's hospitality business, not train operations
• Keio runs 85 km of track, 69 stations and 25 hotels
• Company shut down its network and brought in outside experts
• Tokyo Metro separately disclosed a breach of 59,000 emails