Keio Corporation, the private railway that links Tokyo’s western suburbs to Shinjuku Station, said trains kept running after a ransomware attack hit group companies in late September. Hotel reservations and email did not fare as well.
What happened
The attack came in the early hours of September 26, when several companies in the Keio Railway Group were targeted. Reservation services at some hotels and certain email systems went down. Ransomware is software that locks or steals data so the attacker can demand payment.
The international group Qilin claimed responsibility. According to a cybersecurity company, its statement was confirmed on the morning of October 16 and included 27 images that purport to show internal documents, along with a countdown believed to mark a deadline for releasing stolen data. Qilin is a group that has repeatedly hit companies in various countries.
Keio’s response
Keio said on October 16 that it had confirmed Qilin’s claim to have released some group information. It has not established whether the published material is genuine. A spokesperson said whether customer information has leaked, and whether the data Qilin says it published is real, is “currently under investigation”. No monetary demands have been confirmed.
The company has set up a response headquarters and is working with outside experts and police to trace how the attackers got in and how far the damage goes. It said it will respond promptly if leaks of personal information are confirmed.
Why the trains kept moving
The split between business systems and railway operations is the likely reason the damage stayed contained. Analysts note that large transit operators commonly keep operational technology, the systems behind signalling, scheduling and station work, apart from corporate IT such as reservations, email and retail. Firewalls, strict access rules and monitoring limit what can pass between the two. Keio has not described its own setup, but the outcome fits that pattern.
Extortion groups tend to look for weak points at subsidiaries and partners, and to lean on data theft and public countdowns as much as encryption. Here the disruption fell on hotel and email systems rather than rail control.
A railway with a long record
Keio traces its roots to the Nippon Electric Railway, founded in 1905. It became the Musashi Electric Railway in 1906 and Keio Electric Tramway in 1910, and opened its first interurban stretch, between Sasazuka and Chofu, in 1913. By 1923 the main line from Shinjuku to Hachioji was complete. The Inokashira Line began in 1933 as a separate company, Teito Electric Railway. In 1947 Tokyu shareholders voted to spin off the Keio and Inokashira lines into a new company, and the present name, Keio Corporation, dates from June 2005.
Keio was also among the first railways to reserve priority seats, introduced on September 15, 1973. As of the latest statement, the authenticity of the 27 images was still being checked.
Sources
- Qilin Threatens to Release Data Stolen in Keio Railway Cyberattack
- Keio Corporation
- Japan's Keio Corporation Confirms Ransomware Group "Qilin" Claims Data Release — BigGo Finance
Photo: MaedaAkihiko (CC BY-SA 4.0)
