Loading story…
Keio Corporation confirmed that ransomware compromised servers across its group in the early hours of September 26, disrupting payment, reservation, and customer-service systems at several retail and hospitality businesses. Keio Plaza Hotel Tokyo payment functions may have been affected, while railway operations continued normally because train services operate on a separate system.
Keio isolated its network, notified police, and engaged external specialists to investigate the intrusion route, operational impact, and potential access to customer or business-partner information. The company had not confirmed a data leak or identified a responsible ransomware group at the time of reporting.
See attribution, scope, and your downstream exposure.
2 events from the most recent confirmed update back to the earliest known activity.
Keio Corporation suffered a ransomware attack in the early hours of September 26. It isolated its network, notified police, and began investigating the intrusion with external experts; hospitality, payment, reservation, and customer-service functions were disrupted, while railway operations were unaffected.
Tokyo Metro separately disclosed unauthorized system access that resulted in the acquisition of approximately 59,000 members' email addresses. It said the affected system contained only email addresses and that it had identified and closed the exploited weakness; no connection to the Keio incident was established.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourceteiss.co.uk
Open sourcekeio.co.jp
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Washington Hotel (WHG Hotels/Fujita Kanko Inc.) in Japan** disclosed a **ransomware infection** after attackers gained **unauthorized access to multiple servers**, impacting parts of its internal network. The intrusion was detected on **February 13, 2026, around 22:00 local time**, prompting IT staff to **disconnect external/internet access** to contain spread; the company also notified **law enforcement**, formed an internal **task force**, and brought in **external cybersecurity experts** to investigate root cause, scope, and recovery. Initial findings indicate the attacker accessed **various business-related data** on affected servers, while the company said **customer membership/loyalty data** (including the “Washington Net” program) is likely unaffected because it is hosted/managed on **separate third-party systems** with no confirmed unauthorized access. Operational impact was described as limited, though some properties experienced **temporary credit card terminal outages**; broader guest services reportedly remained functional, and restoration is underway while the company evaluates potential **business/financial impact**. As of reporting, **no ransomware group had publicly claimed** the incident on monitored extortion sites.
Jun 29, 2026
Nihon Kotsu, Japan’s largest taxi operator, said unauthorized external access involving malware compromised parts of its internal environment, forcing the company to disconnect affected systems and suspend several services. The disruption hit taxi dispatch, telephone-based bookings, online hire-car reservations, reservation management, web booking, and some internal systems, leaving customers to rely on the **GO** taxi app, nearby taxi stands, or street hailing while restoration work continues. The company said it has isolated parts of its network and brought in external cybersecurity specialists to investigate the cause, scope, and possible impact of the intrusion. Nihon Kotsu has not confirmed any data leak and said it is still assessing whether customer or partner information was exposed, with notifications to follow if necessary; it also warned customers to be alert for suspicious messages or links impersonating the company.
Jul 20, 2026
Askul, a major Japanese office and household goods retailer, suffered a ransomware attack that severely disrupted its e-commerce and logistics operations. The cyberattack, discovered over a weekend, led Askul to halt all online orders, product shipments, and new user registrations across its three main e-commerce platforms: Askul (office supplies), Lohaco (household goods), and Soloel Arena (corporate clients). The company also suspended customer inquiries due to the system failures caused by the attack. Askul publicly stated that it is investigating the full extent of the incident, including the potential leak of personal and customer data, and has not yet determined when operations will resume. The impact of the attack extended beyond Askul itself, affecting several major Japanese retailers that rely on its logistics network. Muji, a prominent retailer of minimalist household goods and clothing, was forced to take its Japanese online store offline, suspending browsing, purchases, and access to order histories via its app. Muji clarified that only its Japanese online operations were affected, with physical stores and international branches remaining operational. The company is working to identify which customer shipments were impacted and plans to notify affected customers by email. Other retailers, such as Loft and Sogo & Seibu, also reported disruptions, halting online orders and some product shipments due to their reliance on Askul’s logistics systems. Askul’s customer service desk became unreachable, both by phone and online, further complicating the response for affected customers. The attack highlights the interconnectedness of Japan’s retail and logistics sectors, where a single supplier’s outage can cascade across multiple brands and services. The incident follows a series of recent ransomware and cyberattacks targeting Japanese companies, including a notable attack on Asahi, Japan’s largest brewer, earlier in the month. Askul is owned by Yahoo! Japan Corporation and plays a significant role in both business-to-business and business-to-consumer logistics in the country. The company has not disclosed the specific ransomware group responsible, nor the method of initial compromise. Restoration efforts are ongoing, but no timeline for full recovery has been provided. The disruption underscores the vulnerability of supply chain and logistics providers to ransomware attacks and the broad operational impact such incidents can have on dependent businesses. Both Askul and its partners are working to restore services, but the resumption date remains undetermined. The incident has prompted increased scrutiny of cybersecurity practices within Japan’s retail and logistics sectors.
Jun 29, 2026