Ransomware hits Keio’s hospitality network, Tokyo Metro suffers email leak
Over the September 26 weekend, Keio Corporation confirmed ransomware crippled the IT systems that run its 25‑hotel hospitality business, forcing a full network shutdown.
Why it matters
Keio is a major private railway operator in Tokyo, running 85 km of track and 69 stations. While train services kept running, the disruption to its hotels and possibly payment processing could affect thousands of guests and revenue streams worth billions.
Technical snapshot
The attackers encrypted files on the corporate network that supports the hospitality division. Keio has not identified the ransomware family, and no ransom note or claim has surfaced on public channels.
- Network was isolated immediately to stop lateral movement.
- Police have been notified; external forensic experts are engaged.
- Tokyo Metro, a separate transit operator, disclosed that attackers accessed about 59,000 member email addresses and have since patched the vulnerability.
Who’s affected
Hotel guests, staff and vendors that rely on the compromised systems may experience service delays or data exposure. The email breach at Tokyo Metro potentially exposes personal contact information of its members.
Immediate steps for defenders
- Assume the network is compromised and segment critical assets.
- Restore from known‑good backups; verify backup integrity before reconnecting.
- Conduct a forensic review to locate the initial entry point – often phishing or exposed services.
- Update all privileged accounts and enforce multi‑factor authentication.
- For organizations handling guest payments, monitor transaction logs for anomalies.
Both incidents underscore the need for rapid detection and isolation, especially in mixed‑industry operators where a transport backbone shares infrastructure with customer‑facing services.