Keio Corporation, a major private railway operator serving the Tokyo metropolitan area, confirmed on Monday that its network was compromised by a ransomware attack that began over the weekend. The incident, first detected during the early hours of Saturday, led to disruptions across several business systems, though train operations remained unaffected. The company stated that the breach was contained and recovery efforts were underway to restore normal functionality.
The attack targeted internal IT infrastructure, causing outages in administrative and customer service platforms, including ticketing and reservation systems. Keio did not disclose the specific ransomware variant involved or whether any data was exfiltrated, but emphasized that no personal information of passengers had been compromised at this stage. External cybersecurity experts were engaged to assist with forensic analysis and system hardening. The company reported that it did not engage with the attackers or consider paying a ransom, focusing instead on isolating affected segments and rebuilding secure environments.
Despite the cyber incident, Keio assured the public that all railway services continued to operate on schedule throughout the weekend. Operational systems governing train signaling, scheduling, and onboard safety controls run on segregated networks and were not impacted by the breach. This separation of critical infrastructure from general business IT helped prevent any disruption to passenger mobility. Commuter lines serving over 3 million daily riders remained fully functional, with station staff manually assisting customers where digital services were unavailable.
In response to the attack, Keio announced plans to upgrade its network monitoring capabilities and implement multi-factor authentication across all user access points. The company will conduct mandatory cybersecurity training for employees and review third-party vendor access protocols. A post-incident review is scheduled to identify vulnerabilities and improve incident response readiness. Keio also noted that it is coordinating with Japan’s Computer Emergency Response Team (CERT/JP) to share threat intelligence and support broader industry resilience.
Was passenger data stolen in the ransomware attack on Keio? Keio stated that there is currently no evidence that personal information of passengers was accessed or stolen during the incident. The company continues to investigate with cybersecurity experts to confirm the full scope of the breach.
Did the ransomware attack affect train schedules or safety systems? No, train operations were not disrupted. Critical railway systems controlling train movement and safety are isolated from the business network that was affected, ensuring uninterrupted service.
Is Keio planning to pay the ransom to the attackers? Keio has confirmed it did not and will not engage with the attackers or consider paying a ransom. The company is focusing on system restoration and strengthening its cybersecurity posture instead.