Keio Corporation has confirmed a ransomware attack against servers within its group, causing a system outage that has disrupted certain business systems at affiliated companies.
The Japanese railway operator said it identified the incident during the early hours of September 26, 2026, and has launched an investigation with external cybersecurity specialists.
The company stated that rail services remain operational and that it has not confirmed any data leakage so far. However, Keio is still assessing whether the intrusion accessed, stole, or otherwise affected confidential corporate data or customer information.
Ransomware Attack Hits Keio Railway Group Servers
In a public notice issued September 26, Keio said the attack targeted servers used by the wider Keio Group. The organization immediately implemented network-isolation measures intended to contain the incident and prevent further spread across its environment.
Ransomware operations commonly combine encryption with data theft, allowing threat actors to pressure victims through double-extortion tactics. In this model, attackers may threaten to publish stolen files if the victim refuses to pay a ransom, even when systems can be restored from backups.
Keio has not attributed the intrusion to a known ransomware group, disclosed the ransomware variant involved, or confirmed whether any files were encrypted.
The company also did not provide technical details about the initial access vector, such as phishing, stolen credentials, vulnerability exploitation, or a remote-access compromise.
The company reported the attack to law enforcement and said it is working with external experts to identify the entry route, determine the scope of damage, and investigate the affected systems. Keio said it would disclose additional information once it verifies new facts.
According to Keio, the outage has affected sales-related systems at some group companies. The announcement did not identify the subsidiaries involved or specify which customer-facing services, internal processes, payment functions, reservation platforms, or administrative applications are unavailable.
Importantly, Keio said there is currently no impact on railway operations. The statement indicates that train services continued despite the disruption to group business systems, limiting immediate operational consequences for commuters and passengers.
The incident highlights the exposure faced by transportation groups whose operations span rail networks, retail, real estate, hotels, travel, logistics, and other interconnected business units.
Even when operational technology and railway-control networks remain segmented, disruption to enterprise systems can affect ticketing, sales, customer support, supplier coordination, billing, and back-office activities.
Keio said it has not confirmed an information leak at this stage. That finding remains preliminary, as ransomware incident investigations often require detailed review of endpoint telemetry, authentication logs, cloud-service access records, network traffic, and possible attacker-controlled data-exfiltration infrastructure.
The company is examining whether business confidential information and customer-related data were exposed.
Organizations facing ransomware incidents typically need to determine what data was accessible, whether it was copied before containment, and whether notification obligations apply under relevant privacy and data-protection requirements.
Keio apologized for the disruption and concern the incident caused. Its next updates will likely clarify the extent of the sales-system disruption, the number of affected group entities, the recovery timeline, and whether forensic investigators find evidence of data exfiltration.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
