Reported by 9 outlets
Japan's Keio confirms ransomware attack disrupted business systems
Why this score
- Breadth
- 2.00 / 2.0 · 9 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.80 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.16 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
Keio Corporation, the private Japanese railway group operating 85 km of track and 69 stations alongside 25 hotels, more than 2,200 employees, and about $2.6 billion in annual revenue, confirmed a ransomware attack on group servers detected in the early hours of September 26, 2026. The company issued a public notice the same day and implemented network isolation to contain the spread. Train operations continue unaffected because they run on separate systems, but business systems at affiliated companies are disrupted, including credit card and electronic payments, loyalty point accrual, and new reservations at Keio Presso Inn hotels.
The disclosure leaves the important questions open. Keio has not attributed the intrusion to any ransomware group, named the variant, confirmed whether files were encrypted, or disclosed an initial access vector such as phishing or stolen credentials. It is still assessing whether confidential corporate data or customer information was accessed or stolen. A railway-hospitality group of this size holds large volumes of customer payment and loyalty data across retail, hotels, and commuter services, so the target has both data-extortion leverage and public-impact value. No group had claimed the attack as of the September 28 and 29 reports, which leaves open either a delayed claim or an operation focused on silent data theft.
Response here is a containment and verification problem, not a patching one, since no CVE is involved. Review authentication and server logs for the compromised group servers, verify point-of-sale and loyalty system logs for activity between September 26 and the network shutdown, and confirm that operational railway networks remain segmented from corporate and hospitality IT. The Keio Plaza Hotel Tokyo advisory already warns of customer-facing delays, so prepare for phishing that references the disruption. Watch for a leak-site claim confirming exfiltration, any update from Keio on data exposure, and the outcome of the investigation with police and external specialists.
Timeline
-
original reporting
Japan's Keio confirms ransomware attack disrupted business systems
bleepingcomputer.com · 15d ago · September 28th, 2026
Keio Corporation (Keio), a major private railway operator in Japan, said its network was hit by a ransomware attack over the weekend, disrupting some of its business systems. Following a system failure in the early hours of Saturday, the company confirmed the attack and shut down its network to prevent additional damage. The company said it is investigating the extent of the impact and whether the attackers accessed any customer or business partner information. Keio is a large Japanese railway operator with 85 km of track and 69 stations, as well as a separate hospitality business of 25 hotels. The company has over 2,200 employees and a reported annual revenue of about $2.6 billion. “In the early hours of September 26, 2026, we confirmed a ransomware attack on our group's servers. We have reported the incident to the police and are conducting an investigation into the attack's route and damage with the cooperation of external experts,” Keio says . The incident appears to have affected only the hospitality side of Keio’s business, not train operations. A separate announcement published on the company’s Keio Plaza Hotel Tokyo website is warning of possible delays on some customer-facing services. Local media outlets have reported that the cyberattack disrupted the firm's payment systems . At the time of writing, BleepingComputer could not find a ransomware group claiming the attack on Keio. BleepingComputer has contacted the company to request more information about the inciden
-
update from keio.co.jp
Keio Corporation official notice on ransomware system failure
keio.co.jp · 18d ago · September 26th, 2026
Keio Corporation published an official notice dated September 26, 2026, confirming that a ransomware attack on group servers was detected in the early hours of the same day. The company stated it immediately implemented network isolation measures to prevent further damage, reported the incident to police, and began investigating the attack route and damage scope with external experts. Train operations remained unaffected, though some group business systems were disrupted. No information leakage had been confirmed at the time of publication.
-
update from x.com
Hackmanac X alert on Keio ransomware disclosure
x.com · 16d ago · September 27th, 2026
On September 27, 2026 at 07:32 UTC, threat intelligence account Hackmanac posted that Keio Corporation disclosed a ransomware attack detected in the early hours of September 26, affecting group business systems while railway operations stayed unaffected. The post notes the company is investigating whether confidential corporate or customer data was exfiltrated, lists the sector as Transportation / Storage, assigns an ESIX score of 5.60, and links to a full assessment.
-
update from note.com
Note.com user analysis of Keio Group ransomware impact
note.com · 15d ago · September 28th, 2026
A Japanese-language analysis published on September 28, 2026 at 19:58 JST details the confirmed impact across Keio Group businesses following the September 26 ransomware attack. It reports credit card and electronic payment disruptions at some retail stores, suspension of new reservations at Keio Presso Inn, delays at Keio Plaza Hotel, and unavailable loyalty point services. The article emphasizes that no recovery timeline has been announced and cautions users to verify official sources rather than responding to potential phishing messages referencing the incident.
-
update from www.bleepingcomputer.com
Japan's Keio confirms ransomware attack disrupted business systems https:// bleepingcomputer.com/news/security/ japans-keio-confirms-ransomw
www.bleepingcomputer.com · 15d ago · September 28th, 2026
Japan's Keio confirms ransomware attack disrupted business systems https:// bleepingcomputer.com/news/security/ japans-keio-confirms-ransomw
via X https://www.bleepingcomputer.com/news/security/japans-keio-confirms-ransomware-attack-disrupted-business-systems/
-
mentioned by en.hacks.gr
Keio Corporation says a ransomware attack disrupted some corporate systems and that it shut down its network to limit damage. The impact app
en.hacks.gr · 15d ago · September 28th, 2026
-
mentioned by deafnews.it
Keio Corporation confirms ransomware attack. Train services stayed on schedule, but hotel and retail operations hit with payment and reserva
deafnews.it · 15d ago · September 29th, 2026
-
mentioned by cyberworldops.eu
Keio Corporation confirmed ransomware on group servers on Sept 26 after an early-morning system failure, shutting down its network to contai
cyberworldops.eu · 15d ago · September 29th, 2026
-
update from cyberpress.org
Ransomware Attack Hits Keio Railway Group Servers and Disrupts Business Systems
cyberpress.org · 14d ago · September 29th, 2026
Keio Corporation has confirmed a ransomware attack against servers within its group, causing a system outage that has disrupted certain business systems at affiliated companies. However, Keio is still assessing whether the intrusion accessed, stole, or otherwise affected confidential corporate data or customer information. Ransomware Attack Hits Keio Railway Group Servers In a public notice issued September 26, Keio said the attack targeted servers used by the wider Keio Group. Ransomware operations commonly combine encryption with data theft, allowing threat actors to pressure victims through double-extortion tactics. In this model, attackers may threaten to publish stolen files if the victim refuses to pay a ransom, even when systems can be restored from backups. The company also did not provide technical details about the initial access vector, such as phishing , stolen credential
-
update from gbhackers.com
Keio Railway Confirms Ransomware Attack Disrupted Business Systems
gbhackers.com · 14d ago · September 29th, 2026
In a public notice issued on September […] The post Keio Railway Confirms Ransomware Attack Disrupted Business Systems appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .