A Keio Corporation ransomware attack has taken down payment and reservation systems across several of the Japanese group’s businesses, with Keio Store locations among those left unable to process card or e-money transactions. The attack was confirmed by the company after a system failure in the early hours of Saturday, 26 September 2026.
In a statement, Keio Corporation said: ‘In the early hours of September 26, 2026, we confirmed a ransomware attack on our group’s servers. We have reported the incident to the police and are conducting an investigation into the attack’s route and damage with the cooperation of external experts.’ The company shut down its network following the discovery to limit further damage.
Keio Corporation ransomware attack hits hospitality and retail hardest
Train operations appear to have been unaffected. The disruption landed squarely on the hospitality and retail arms of the business. According to Teiss, the attack disrupted payment and reservation systems across several of Keio’s retail and hospitality businesses. A separate announcement on the Keio Plaza Hotel Tokyo website warned of possible delays to some customer-facing services.
The impact spread wider than just the hotel side. TMC Insight reports that Keio Store, Keio Plaza Hotel, and Keio Bus were all among the businesses experiencing disruption, with Keio Store customers unable to pay by card or e-money at affected locations. For a group that runs retail, hospitality and transport under one roof, the knock-on effects of a single network compromise quickly multiply.
Keio is investigating whether the attackers accessed any customer or business partner data. At the time of writing, no ransomware group had publicly claimed responsibility for the incident.
A second Japanese rail operator hit in the same weekend
The timing is awkward for the Japanese transport sector more broadly. Tokyo Metro disclosed a separate cyber incident over the same weekend, in which attackers gained unauthorised access to systems and obtained 59,000 member email addresses. Tokyo Metro runs nine subway lines covering 195 km and 180 stations, carrying an average of 7 million passengers daily.
Tokyo Metro said the breached systems held only email addresses, and that the security weakness exploited by the attackers has already been identified and closed. Whether the two incidents are connected remains unknown. It is unclear if Keio and Tokyo Metro were targeted in a coordinated campaign by the same threat actor.
Keio itself is no small outfit. The group operates 85 km of track and 69 stations, with a hospitality arm comprising 25 hotels. It employs over 2,200 people and has a reported annual revenue of about $2.6 billion. The breadth of the non-rail business (stores, hotels, bus services) is precisely what gave a network-level attack so many places to land.
The company is continuing its investigation with external experts and has asked for cooperation from authorities. Keio has not yet confirmed whether customer data was compromised, and has indicated it will provide further updates as the investigation progresses.
