Loading story…
Nihon Kotsu, Japan’s largest taxi operator, said unauthorized external access involving malware compromised parts of its internal environment, forcing the company to disconnect affected systems and suspend several services. The disruption hit taxi dispatch, telephone-based bookings, online hire-car reservations, reservation management, web booking, and some internal systems, leaving customers to rely on the GO taxi app, nearby taxi stands, or street hailing while restoration work continues.
The company said it has isolated parts of its network and brought in external cybersecurity specialists to investigate the cause, scope, and possible impact of the intrusion. Nihon Kotsu has not confirmed any data leak and said it is still assessing whether customer or partner information was exposed, with notifications to follow if necessary; it also warned customers to be alert for suspicious messages or links impersonating the company.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
Following the cyberattack, Nihon Kotsu warned customers to watch for fraudulent messages impersonating the company. The notice accompanied its ongoing response and restoration efforts after the malware-linked intrusion.
The company brought in external cybersecurity specialists to investigate the cause and scope of the attack, restore systems, and assess possible data exposure. Nihon Kotsu said no information leak had been confirmed so far and that affected individuals would be notified if necessary.
In response to the intrusion, Nihon Kotsu disconnected or isolated affected systems and parts of its internal network. The disruption temporarily impacted taxi dispatch, hire car reservations, web booking, telephone dispatch, reservation management, and some internal systems.
Nihon Kotsu disclosed that its internal systems were compromised through unauthorized external access involving malware on July 11, 2026. The incident affected the company's internal environment and triggered its incident response.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
7 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcescworld.com
Open sourcecybernews.com
Open sourcesecurityaffairs.com
Open sourceteiss.co.uk
Open sourcenihon-kotsu-taxi.jp
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Keio Corporation confirmed that ransomware compromised servers across its group in the early hours of September 26, disrupting payment, reservation, and customer-service systems at several retail and hospitality businesses. Keio Plaza Hotel Tokyo payment functions may have been affected, while railway operations continued normally because train services operate on a separate system. Keio isolated its network, notified police, and engaged external specialists to investigate the intrusion route, operational impact, and potential access to customer or business-partner information. The company had not confirmed a data leak or identified a responsible ransomware group at the time of reporting.
Sep 30, 2026
**Washington Hotel (WHG Hotels/Fujita Kanko Inc.) in Japan** disclosed a **ransomware infection** after attackers gained **unauthorized access to multiple servers**, impacting parts of its internal network. The intrusion was detected on **February 13, 2026, around 22:00 local time**, prompting IT staff to **disconnect external/internet access** to contain spread; the company also notified **law enforcement**, formed an internal **task force**, and brought in **external cybersecurity experts** to investigate root cause, scope, and recovery. Initial findings indicate the attacker accessed **various business-related data** on affected servers, while the company said **customer membership/loyalty data** (including the “Washington Net” program) is likely unaffected because it is hosted/managed on **separate third-party systems** with no confirmed unauthorized access. Operational impact was described as limited, though some properties experienced **temporary credit card terminal outages**; broader guest services reportedly remained functional, and restoration is underway while the company evaluates potential **business/financial impact**. As of reporting, **no ransomware group had publicly claimed** the incident on monitored extortion sites.
Jun 29, 2026
Uber disclosed that an attacker breached its internal environment after socially engineering a contractor and abusing push-based multi-factor authentication. According to Uber and multiple reports, the intruder used stolen credentials to access the company over VPN, then moved through internal resources including **Slack**, **Google Workspace**, Windows domain systems, AWS, VMware infrastructure, dashboards, and the company's **HackerOne** bug bounty account. The attacker reportedly found privileged credentials in internal scripts tied to privileged access management, enabling broader access to secrets and administrative systems. Uber said core services remained operational and that it found no evidence that sensitive customer data such as trip histories, credit card information, or cloud-stored user records were accessed, though internal Slack messages and finance-related files were downloaded. A particularly serious consequence was the exposure of Uber's private HackerOne submissions, raising the risk that unfixed vulnerabilities were revealed. Uber later said the activity was likely linked to a person associated with **LAPSUS$**, citing tactics similar to earlier intrusions at major technology firms, and said it was working with the FBI and DOJ while strengthening defenses against MFA fatigue and social-engineering attacks.
Jun 29, 2026