The Keio Electric Railway Group was hit by a ransomware attack, and the Russian-linked hacker group Qilin claimed responsibility after releasing images purportedly showing internal documents. The impact on train operations was limited because they run on an independent network, but hotel reservations and payment functions were affected.
The Keio Electric Railway Group detected a ransomware attack on its servers in the early hours of 26 September 2026 and took measures including disconnecting the network to prevent the damage from spreading. No train cancellations or other disruptions occurred because the control systems for railway operations were run on an independent network, but the infrastructure supporting business operations was affected. The suspension of accommodation reservation services at Keio Plaza Hotel and of cashless payment and points-accrual functions at Keio Store was confirmed.
On 15 October, Qilin posted information concerning Keio Electric Railway on a leak site on the dark web. The 27 images released included documents in the form of outsourced service agreements, internal emails and employment-related summary materials, and a countdown timer showing the remaining time was also posted. In response, Keio Electric Railway issued its second report on 16 October, disclosing that an organization claiming to have carried out the attack had released some information.
The company is verifying with external experts and the police whether the source of the released images was actual data, and says that no personal information leak had been confirmed as of its initial report on 26 September. It has stated that it will continue working to determine the full extent of the leak and take appropriate action. Qilin has carried out cyberattacks targeting companies around the world and is reportedly known to make frequent use of double extortion, threatening to publish stolen data.