Loading story…
Washington Hotel (WHG Hotels/Fujita Kanko Inc.) in Japan disclosed a ransomware infection after attackers gained unauthorized access to multiple servers, impacting parts of its internal network. The intrusion was detected on February 13, 2026, around 22:00 local time, prompting IT staff to disconnect external/internet access to contain spread; the company also notified law enforcement, formed an internal task force, and brought in external cybersecurity experts to investigate root cause, scope, and recovery.
Initial findings indicate the attacker accessed various business-related data on affected servers, while the company said customer membership/loyalty data (including the “Washington Net” program) is likely unaffected because it is hosted/managed on separate third-party systems with no confirmed unauthorized access. Operational impact was described as limited, though some properties experienced temporary credit card terminal outages; broader guest services reportedly remained functional, and restoration is underway while the company evaluates potential business/financial impact. As of reporting, no ransomware group had publicly claimed the incident on monitored extortion sites.
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
As of the disclosures, restoration of affected systems was underway while the company assessed financial and business impact and continued investigating possible exfiltration. No ransomware group had publicly claimed responsibility for the attack on monitored extortion sites.
Around 2026-02-16 to 2026-02-17, Washington Hotel disclosed that it had suffered a ransomware attack and that business data on affected servers may have been exposed. The company said customer and loyalty program data were likely unaffected because they were hosted on separate third-party-managed systems.
Following the server compromise, some hotel properties experienced temporary credit card terminal outages and related service issues. Washington Hotel said guest services remained largely functional and that there was no major overall operational disruption.
After detecting the attack, IT staff disconnected affected servers and external network access to contain the breach. The company formed an internal task force, engaged external cybersecurity experts, and notified police to investigate the cause, scope, and possible data exposure.
On 2026-02-13 at about 22:00 local time, Washington Hotel detected unauthorized access to multiple servers in a ransomware incident. The intrusion affected parts of its internal network and led to confirmed access to business data on compromised systems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourceteiss.co.uk
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Keio Corporation confirmed that ransomware compromised servers across its group in the early hours of September 26, disrupting payment, reservation, and customer-service systems at several retail and hospitality businesses. Keio Plaza Hotel Tokyo payment functions may have been affected, while railway operations continued normally because train services operate on a separate system. Keio isolated its network, notified police, and engaged external specialists to investigate the intrusion route, operational impact, and potential access to customer or business-partner information. The company had not confirmed a data leak or identified a responsible ransomware group at the time of reporting.
Sep 30, 2026
Multiple organizations disclosed or were linked to **ransomware/data-extortion** activity with material operational or privacy impact. **Air Côte d’Ivoire** confirmed a cyberattack affecting parts of its information systems after **INC ransomware** claimed theft of **208 GB** and threatened to leak data, while the airline said it engaged the national CERT and external experts to contain impact and maintain flight operations. In the US healthcare sector, **University of Mississippi Medical Center (UMMC)** reported a ransomware incident that forced statewide clinic closures and disrupted access to **Epic** electronic medical records, prompting engagement with the **FBI** and **CISA** and use of downtime procedures to sustain patient care. Separately, **Conduent**’s earlier ransomware-linked breach continued to expand in scope, with breach notifications indicating at least **~25 million** people affected across multiple states and exposure of sensitive PII (including **SSNs** and health/insurance data). **Wynn Resorts** also confirmed an unauthorized party accessed and stole employee data after being listed by the **ShinyHunters** extortion group, with the company stating the actor claimed the data was deleted and that guest operations were not impacted. Other items in the set describe distinct, unrelated security events and broader threat research rather than the same incident: alleged data leaks involving **Burger King France** and **Wendy’s UK**; **Qilin** ransomware claims against a New York City transit union; Russian cyber operations against Ukraine’s power grid focused on intelligence collection; and a New Zealand healthcare application (**MediMap**) taken offline after apparent unauthorized access and **patient record tampering** (e.g., records marked deceased). Additional references cover threat research and trends (airline brand impersonation domains, edge-device exploitation telemetry, MuddyWater’s *Operation Olalampo*, Google Ads cloaking via **1Campaign**, freight/logistics phishing by “Diesel Vortex,” and various governance/AI/5G/quantum commentary), which provide context on the threat environment but do not substantively report on the same specific breach event.
Jun 29, 2026
Nihon Kotsu, Japan’s largest taxi operator, said unauthorized external access involving malware compromised parts of its internal environment, forcing the company to disconnect affected systems and suspend several services. The disruption hit taxi dispatch, telephone-based bookings, online hire-car reservations, reservation management, web booking, and some internal systems, leaving customers to rely on the **GO** taxi app, nearby taxi stands, or street hailing while restoration work continues. The company said it has isolated parts of its network and brought in external cybersecurity specialists to investigate the cause, scope, and possible impact of the intrusion. Nihon Kotsu has not confirmed any data leak and said it is still assessing whether customer or partner information was exposed, with notifications to follow if necessary; it also warned customers to be alert for suspicious messages or links impersonating the company.
Jul 20, 2026