Key takeaways

  • Keio Corporation (京王電鉄), which runs one of Tokyo's major commuter rail networks along with retail, hotel and real estate businesses, confirmed a ransomware attack on a group server in the early hours of September 26, 2026.
  • Business systems at some group companies were disrupted. News reports say credit card payments stopped working at some Keio group stores and hotel reservations were affected.
  • Train services are running normally.
  • Keio says it has not confirmed any data leak, but is investigating whether confidential business information and customer information were taken. It has reported the attack to the police.
  • On October 16, the ransomware group Qilin listed Keio on its leak site, according to ransomware.live. Keio says it has confirmed that a group claiming the attack says it has published part of the Keio group's data, and is checking whether it is genuine.

Update, October 17: Qilin has listed Keio on its leak site, and Keio confirms that a group claiming the attack says it has published part of its data. See Qilin claims the attack.

What happened#

Keio published a notice on September 26, the same day it confirmed the attack. According to the notice:

  • In the early hours of September 26, Keio confirmed a ransomware attack on a server belonging to the Keio group, which caused system failures.
  • It has reported the attack to the police and is investigating the attack route and the damage with outside experts.
  • It immediately took steps to stop the damage spreading, including cutting off network connections.
  • Business systems at some group companies have been disrupted. Train operations are not affected.
  • It has not confirmed any leak of information. It is investigating the scope of the impact, including whether confidential business information or customer information was taken.

What was affected#

Keio's notice does not name the group companies or services involved. News reports add:

Service Status Source
Credit card payments at some Keio group retail stores Not working Kyodo News
Hotel reservations Affected ANN
Keio train services Running normally Keio

Keio's businesses are split across many companies. The railway is run by Keio Corporation itself. Hotels such as the Keio Plaza Hotel and retail such as Keio Department Store and Keio Store are run by separate group companies.

The notice says the attack hit "a server of the Keio group", not which company owns it. It could belong to Keio Corporation itself, to a subsidiary, or to a system shared across the group. What Keio does say is that the disruption hit the business systems of some group companies.

Qilin claims the attack#

Added October 17, 2026.

On October 16 (Japan time), the ransomware group Qilin added "Keio Corporation" to its leak site, according to ransomware.live, which monitors such sites. That was 20 days after Keio confirmed the attack. According to TBS, citing a security company, the post included 27 images presented as internal Keio documents and a countdown, apparently to the publication of more data. We have not viewed the leak site, and these are the attackers' claims.

Keio published a second report the same day. It does not name Qilin, but says:
The claim Keio has confirmed that "an organization claiming to have carried out the attack" says it has published part of the information held by the Keio group
Status It is checking the facts with outside experts, and "trying to obtain accurate information"
Personal data If a leak of personal data is confirmed, it will respond promptly
Response A response headquarters covering the whole group is investigating the scope and restoring systems, with the police and outside experts

Nikkei and the Asahi Shimbun report that Keio confirmed the claim is Qilin's, that whether the published material is genuine and whether customer data was taken are still under investigation, and that no monetary demand has been confirmed, according to Keio's press office.

Qilin is the group most often linked to attacks on Japanese organizations on ransomware.live this year: it has also listed Ikegami Tsushinki, Musashino University and the Anabuki group. A man believed to be one of its leaders was detained in Japan in May and handed to Germany on October 2. The listing of Keio is a reminder that an arrest does not stop a ransomware operation's leak site.

What we don't know yet#

Keio has not said:

  • Whose server was attacked (Keio Corporation itself or a group company), or which stores and hotels are affected
  • How the attackers got in
  • Whether the data Qilin claims to have published is genuine, and whether it includes customer or employee personal data
  • Whether it received a ransom demand. It told reporters none has been confirmed

Our analysis#

Named as ransomware from the start#

Japanese companies often describe attacks in vague terms at first. Common phrases include "system failure" (システム障害), "unauthorized access" (不正アクセス) or "a large volume of access from outside". Keio's notice says "ransomware" in its title, on the same day it confirmed the attack. It also says plainly that it is checking whether confidential information and customer data were taken.

That clarity helps. Customers know what kind of risk they face, and other companies know what kind of attack to look for. The next test is the follow-up: whether Keio explains how the attackers got in and what data, if any, was taken.

Update, October 17: Keio's second report, three weeks later, is short. It acknowledges the leak site claim the day it appeared, which is to its credit, but adds nothing on how the attackers got in or what systems held the data now claimed to be published.

The railway held, and that deserves credit#

Whether the compromised server belonged to Keio Corporation itself or to a group company, the result is the same: payments and reservations failed, and the trains kept running. That strongly suggests Keio keeps its rail operating systems separated from its business IT, and that the separation held under a real attack. For a railway that carries commuters into central Tokyo every day, that is exactly the outcome network segmentation is meant to deliver, and Keio deserves credit for it.

The disruption to group businesses is a familiar pattern. Recent ransomware attacks on Japanese companies have hit group and subsidiary systems that run everyday business: payments, reservations, ordering and logistics. Japan's National Police Agency counted 123 ransomware cases in the first half of 2026, the most for any six-month period since it began tracking the figure. See our overview of ransomware in Japan for the full police data.

What this means for readers#

  • If you are traveling in Tokyo, Keio trains are running normally. Some Keio group stores may not accept credit cards for now, so carry another way to pay.
  • If you have a booking at a Keio group hotel, check with the hotel directly if you need to make or change a reservation.
  • If you are a Keio group customer or business partner, watch for follow-up notices from Keio about whether any data was taken, and be wary of unexpected messages that mention Keio. If you exchanged business documents with Keio group companies, assume they may appear in a leak and prepare for targeted phishing.
  • If you defend a Japanese organization, treat Qilin's continued activity as a current threat, whatever happens to individual members.

Japanese terms at a glance#

Japanese Reading Meaning
京王電鉄 Keiō Dentetsu Keio Corporation (Keio Electric Railway)
ランサムウェアによる攻撃 ransamuwea ni yoru kōgeki Ransomware attack
システム障害 shisutemu shōgai System failure
営業システム eigyō shisutemu Business (operational) systems
ネットワーク遮断措置 nettowāku shadan sochi Cutting off network connections
情報漏洩 jōhō rōei Data leak

We will update this article when Keio publishes the results of its investigation.