Keio Corporation

Summary

On September 26, 2026, Keio Corporation confirmed a ransomware attack and isolated affected network systems. Railway operations reportedly continued normally, although some sales and reservation systems at affiliated Keio Group companies were disrupted. No threat actor was identified.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On September 26, 2026, Keio Corporation confirmed that it had experienced a ransomware attack. The company, which operates one of the Tokyo region’s major private rail lines, isolated or disconnected affected network systems as part of its initial response. Despite the confirmed ransomware incident, railway operations continued normally, with no reported interruption to train services. The disclosure came one day after Times Mobility reported unauthorized access to a Times Car website or related system on September 25. The two organizations described the incidents as separate and unrelated, and no connection between them had been confirmed.

Keio’s containment response focused on separating affected systems from the rest of its network while investigators examined the intrusion. The company stated that it was working with outside specialists and had notified the police. Its public disclosure did not identify an entry vector, ransomware family, ransom demand, or other technical detail. No on-record statement from a named Keio representative was identified in the available reporting. The absence of those details left the incident’s technical cause and full scope undetermined at the time of the disclosure.

The immediate operational impact was limited. Keio reported that core railway services were not affected, while some business systems within the Keio Group, including sales or reservation systems operated by affiliated companies, were reportedly disrupted. The extent of those business-system disruptions was not confirmed in full. Neither normal railway operations nor broader commercial operations were reported to have halted. The separation between train operations and affected business systems meant that the confirmed ransomware event did not produce a reported interruption to commuter-facing rail service.

As of the latest reporting, no information leak had been confirmed for Keio Corporation. The company was still investigating whether confidential business information or customer data had been accessed or exfiltrated, and it had not publicly established the number of affected records, if any. Keio had also not confirmed that customer-facing systems such as ticketing, loyalty programs, or payment processing had been compromised. The investigation therefore remained focused on determining whether the ransomware’s reach extended beyond the isolated network segments and whether any data loss or exposure accompanied the attack.

The Keio incident was disclosed amid a wider increase in reported ransomware activity and heightened attention on Japanese transportation and mobility organizations. Its visibility was increased by Keio’s role as a major railway operator, even though the operational effect was concentrated outside the systems directly controlling train service. The confirmed response sequence was rapid network isolation, continued railway operation, engagement with external specialists, and notification of law enforcement. By October 5, 2026, Keio’s forensic investigation was still ongoing, with no confirmed data leak, no published technical attribution, and no further detail on the extent of the affected business systems.

Sources

Sources available to members: 1 source.