Keio derailed by ransomware

Article by Nacata Security, 29/09/2026

Can you imagine a cyberattack cutting off payment at your Tokyo hotel?

That’s exactly what happened on September 26 at Keio Corporation.

Keio is no ordinary company: it operates 85 kilometers of railway, 69 stations, and a chain of 25 hotels with more than 2,200 employees.

With an annual revenue of $2.6 billion, a hit to its servers is no minor incident — it’s a shockwave that affects thousands of people.

The attack came in the early hours of the morning, without any warning.

In the first hours of Saturday, Keio Group’s systems began to fail silently. The company detected the ransomware, confirmed the intrusion, and made the only possible decision: disconnect the network to prevent the damage from spreading. It then notified the police and called in external experts to trace how the attackers had gotten in and how far they had reached.

The trains kept running, but the hotels did not.

The ransomware appears to have struck only the hotel arm of the group, not its railway operations. Even so, the impact was immediate: payment systems were disrupted and the Keio Plaza Hotel Tokyo website warned of delays in customer services. Keio is now investigating whether the attackers accessed customer or business partner data — a question that remains unanswered.

No ransomware group has yet claimed responsibility for the attack.

That absence of attribution is an unsettling signal in itself. Major ransomware groups publish their victims to pressure them into paying. The fact that no one has raised their hand may mean that negotiations are underway, that the group prefers silence, or that this is a lesser-known threat actor.

And Keio was not alone that night.

That same weekend, Tokyo Metro revealed that unidentified attackers had accessed its systems and extracted 59,000 email addresses belonging to its users. Two Japanese railway operators hit within the same timeframe raises a question that no one has yet answered.

Was this a coordinated campaign against Japan?

Authorities have not confirmed any link between the attack on Keio and the breach at Tokyo Metro. But the timing is hard to ignore. Japan has been in the crosshairs of cyber espionage and cybercrime groups with geopolitical ties for months, and the transportation sector is a strategic target: disrupting it generates panic, media pressure, and sometimes quick payments.

Tokyo Metro closed the gap, but the damage was already done.

The metro operator confirmed that the compromised systems contained only email addresses, and that it had already identified and closed the vulnerability that was exploited. That is the best that can be said in a scenario like this. But 59,000 email addresses in unknown hands represent 59,000 potential phishing vectors against real users.

Ransomware targeting critical infrastructure is nothing new, but it is becoming more frequent.

Hospitals, airports, railway companies: attackers seek out sectors where the pressure to restore service is at its highest and tolerance for downtime is at its lowest. That combination makes victims far more likely to pay.

The real question is who is behind it.

With no group having claimed responsibility, investigators are working blind on attribution. Every hour that passes without a name reduces the chances of understanding whether this was pure opportunism, a targeted attack against Japan, or the opening move of a broader campaign that is not yet over.

Attribution changes everything now.

Knowing who attacked Keio defines the response, the possible sanctions, and the level of alert that other companies in the sector must activate.

How many more attacks does it take before this truly concerns me?

Security is not improvised, it is audited. At Nacata Security we detect vulnerabilities and protect your company, because a single flaw can cost you everything you have built.

Related articles

Nacata Security, reach out to us anytime