Keio Ransomware Attack Disrupts Payments and Hotel Bookings, While Trains Keep Running

Here is what has been confirmed, what has only been reported, and what is still unknown.

What Keio has officially confirmed​

Keio posted its incident notice on September 26. In it, the company said it had confirmed that a ransomware attack caused a system failure and that it is investigating the scope of the impact, including whether confidential business information or customer information was leaked.

The notice makes these points:

• Timeline: In the early hours of September 26, 2026, the company confirmed a ransomware attack on a Keio Group server. It has reported the incident to police and is investigating the attack route and damage with help from outside experts.
• Containment: Keio took measures including network disconnection to stop the damage spreading.
• Scope: When the notice was issued, business systems at some group companies were disrupted. Rail operations were not affected. No information leak had been confirmed, and the investigation was continuing.
• Follow-up: Keio said it would announce new findings promptly.

Read the data-leak wording carefully. "Not confirmed" means the investigation hasn't finished. It doesn't mean no data was taken. Modern ransomware crews often steal data before they encrypt anything, and victims frequently learn the full extent of that theft only weeks later.

BleepingComputer, which reported the incident in English, describes Keio as operating 85 km of track and 69 stations, plus a hospitality business of 25 hotels. It puts the company at more than 2,200 employees and about $2.6 billion in annual revenue. When BleepingComputer published, it had not found any ransomware group claiming the attack.

Section summary: The ransomware classification, the police report, the outside forensic help and the network disconnection are all confirmed. The data exposure question is open.

Where the disruption actually showed up​

Keio's group-wide notice doesn't say which group companies were hit. Japanese media and the subsidiaries' own notices fill in much of that picture.

The details, source by source:

• Keio Store announced on September 27 that the group system failure left some stores unable to take credit card or e-money payments, or to award and redeem points.
• Keio Plaza Hotel said on September 26 that its server had been hit by ransomware, and that replies to inquiries from its official website form and booking sites could be delayed or impossible. The hotel notice reviewed for this article, from the Keio Plaza Hotel Hachioji site, also mentions an external network disconnection and coordination with Keio Electric Railway. It says hotel operations were not affected at the time.
• Keio Presso Inn said the system failure meant it would stop accepting new reservations for the time being. Keio Bus said credit cards could not be used at its commuter pass sales counters.
• Nikkei gave a later snapshot. As of the evening of September 27, hotel reservations and cashless payments at some retail stores were still unavailable. Keio Presso Inn had stopped new reservations and email inquiries. Keio Plaza Hotel was operating normally but checking whether information had leaked. At Keio Store, credit cards and QR-code payments were unusable, points could not be awarded, and some stores were still cash-only on the 27th.

This corrects one point in the early English coverage. BleepingComputer wrote that the incident "appears to have affected only the hospitality side" of the business. The Japanese reporting shows retail and bus ticketing were hit as well.

Another item on Keio's corporate news page is worth noting. On September 28, Keio posted an announcement about a system failure affecting its "inquiry form," next to a notice about applications for group tickets, the Keio Liner private-compartment plan and a location-filming service. Keio's page doesn't connect either item to the ransomware attack, so readers shouldn't assume a link. It does suggest customer-facing web services are having a rough week.

Section summary: Card and cashless payments at retail stores, hotel bookings and inquiries, and bus pass payments were hit. Rail service was not.

The Tokyo Metro incident is a separate case​

BleepingComputer also noted that Tokyo Metro disclosed its own incident the same weekend. Attackers gained unauthorized access and reached about 59,000 member email addresses. Tokyo Metro says the affected systems held only email addresses and that it has closed the weakness the attackers used.

The two companies share a city and an industry, but no public evidence links the incidents. BleepingComputer says outright that it is unclear whether the same threat actor was involved. Tokyo Metro's incident was unauthorized access affecting email addresses. Keio's is a ransomware incident that disrupted business systems. Treat them as separate cases unless investigators say otherwise.

Why trains kept running (and what we can't conclude)​

It's tempting to call the unaffected rail operations a win for network segmentation. That might be right, but Keio hasn't said so. The company hasn't described its architecture, the intrusion method, the ransomware family, or which servers were encrypted. What the evidence does show is that operational rail systems and commercial group systems had different outcomes.

Speaking from general industry experience rather than anything Keio has disclosed, this pattern is common in transport and utility incidents. Operational technology such as signalling and train control usually runs on separate networks, while payment processing, loyalty programs, reservations and CRM run on shared corporate IT. Ransomware often hits the shared layer. Shared identity systems, shared payment gateways and the flat networks that tend to build up in group structures with many subsidiaries are frequent paths for an attack to spread.

So is it a success story? Only partly. Customers still couldn't pay by card at the supermarket or book a room. A security design that protects the trains while the tills fail is still an incident, just a smaller one.

Section summary: The rail/business split is a verified outcome. The reason for it hasn't been disclosed.

What IT admins can take from this​

Keio hasn't published indicators of compromise, a CVE, or an initial access vector, so there are no specific detection rules to deploy. The practical lessons below are general ransomware-resilience practice, not findings from this case:

1. Map shared services across subsidiaries. Payment gateways, loyalty platforms and Active Directory forests shared by retail, hospitality and transport units can let one intrusion become a group-wide outage. Know which business units share infrastructure before an attacker works it out for you.
2. Rehearse the network-disconnection decision. Keio and its hotel both moved fast to disconnect networks. Decide ahead of time who has authority to pull that trigger, and which revenue systems go down when they do.
3. Plan for cash-only operation. Some Keio Store locations reportedly fell back to cash. Retail and hospitality teams should document manual fallbacks for payments, check-in and reservations.
4. Keep "encrypted" and "exfiltrated" separate in communications. Keio's notices do this well. They confirm the ransomware, confirm the police report, and describe data exposure as unconfirmed and still under investigation. Customers and regulators take that kind of precision better than promises that later turn out to be wrong.
5. Watch customer channels. When web forms and booking-site inquiries go down, phishing that impersonates the affected brand usually follows. It's worth warning customers early that the company won't ask for card details by email.

What happens next​

The open questions are the ones that matter most:

• Was data taken, and whose? That could include customers, business partners or employees.
• Which ransomware group is responsible, and will it post Keio on a leak site?
• How did the attackers get in, and how far did they get across the group's servers?
• When will card payments and reservations be restored?

Keio says it will publish new findings as they emerge, and TV Asahi reported that the company is aiming for a quick recovery. If Keio customers get notices from Keio Store, Keio Plaza Hotel or Keio Presso Inn, they should check them against each company's official site. They should also be wary of unsolicited messages that bring up the incident and ask for payment or login details.

The trains are on time for now, but the forensic investigation into what reached the business side is still going.