OrganisationJP

Keio Corporation

Tokyo rail, bus and property group.

On 26 September, Keio Corporation disclosed ransomware disruption to group sales systems and hotel servers while its trains continued running; Qilin later posted files it claimed came from Keio.

Last refreshed: 22 October 2026 · Appears in 1 active topic

Key Question

Were the files Qilin posted from Keio genuine?

Timeline for Keio Corporation

#15 14 Oct

Confirmed the release of its files

Cybersecurity: Threats and Defences: SiteGuard hit; Qilin posts Keio files

View full timeline →

Follow Cybersecurity: Threats and Defences →

Background

Keio Corporation is a Japanese railway and property company established on 1 June 1948 and the core business of the Keio Group. It operates the Keio and Inokashira railway lines across western Tokyo and northern Kanagawa. The two lines form an 84.7-kilometre network serving the capital's western side.

Rail transport sits beside Keio's property activities and other group businesses. This mix makes the railway company both a passenger operator and the centre of a broader corporate group. The distinction matters when assessing events elsewhere in that group: disruption to a hotel or subsidiary sales system does not by itself mean that Keio's trains stopped. The company also uses the names Keio Electric Railway and 京王電鉄株式会社.

Key Issues

Ransomware attack

Keio kept its trains running

Keio Corporation disclosed on 26 September that ransomware had affected group sales systems and Keio Plaza Hotel servers. Railway operations continued, separating the attack's business-system impact from the company's train service.

Qilin posted files on 15 October that it claimed came from Keio. Keio acknowledged the publication and asked outside experts to check whether the material was genuine. The company's confirmed impact therefore remains disruption to named group systems while its trains continued operating; the authenticity of Qilin's published material remained under review.

Common Questions

What is Keio Corporation?

Keio Corporation is a Japanese railway and property company that operates the Keio and Inokashira lines around western Tokyo.Source: Keio Corporation

What did the Keio ransomware attack affect?

Keio said the attack disrupted some group servers and subsidiary sales systems, while investigators examined possible data exposure.Source: Keio Corporation

Did the Keio cyberattack stop its trains?

No. Keio's initial disclosure said railway operations were unaffected by the ransomware incident.Source: Keio Corporation

Were Qilin's claimed Keio files genuine?

Keio acknowledged that files had been published but said outside experts were still checking whether the material was genuine.Source: Keio Corporation

Source Material

Keio Corporation news releases Notice and apology concerning system failure due to ransomware attack Keio Corporation company profile

How the World Sees Them

FirstVDS

There are no traces of the attack on the affected virtual servers

ESET

first documented case of Yggdrasil being abused in this way by a state-aligned threat actor

Cyber Security Agency of Singapore

Attackers are exploiting

Canadian Centre for Cyber Security

open-source reporting indicating that the vulnerability is being exploited in the wild

Ahold Delhaize (Frans Muller)

was caused by the malicious actions of others

ENISA

the manufacturer is not required to comply with the vulnerability handling obligations

CERT-FR (ANSSI)

probablement toujours en cours

ASOS

impersonating a trusted contact

Check Point

actively exploited on Spark Firewalls as of September 12, 2026

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Updated 22 October 2026. Editorial standards.