Twenty-seven images are at the center of a dispute between Keio Corporation and the ransomware group Qilin. The hackers say the images show internal documents taken from subsidiaries of the Tokyo railway operator. Keio says it has not yet established whether they are genuine.
What happened
The attack came in the early hours of September 26, when several companies in the Keio Railway Group were hit with ransomware. The company said it disrupted business systems at some subsidiaries, leaving reservation services at some hotels and certain email systems unavailable. Railway operations were not affected, the company stated.
On October 16, a cybersecurity company confirmed that Qilin had published a statement claiming responsibility. Alongside the 27 images, the group posted a countdown that is believed to mark a deadline for making stolen information public. Keio acknowledged the claim that some subsidiary information had been released.
Keio’s response
The company has set up a response headquarters and is working with external experts and police to find the attack route and the extent of the damage. A spokesperson said that whether customer information leaked, and whether the data Qilin says it published is real, were both under investigation. According to the company, no monetary demand has been confirmed. It said it would respond promptly if a leak of personal information is confirmed.
Keio is the central firm of a group with interests in transport, retail and real estate. Its subsidiaries include Keio Department Store, Keio Store, Keio Realty and Development, Keio Travel Agency and Keio Plaza Hotel. The disruption was confined to business systems at some of those subsidiaries. Its rail network, which links western Tokyo suburbs and Sagamihara with Shinjuku Station, kept running.
The pressure tactic
Qilin has repeatedly carried out ransomware attacks on companies in various countries. Ransomware is malicious software used to demand payment from victims, and posting a sample of stolen material beside a countdown is a way of pushing a victim toward paying. Keio has not yet said how the attackers got in.
Sources
- Qilin Threatens to Release Data Stolen in Keio Railway Cyberattack
- Keio Corporation
- Japan's Keio Corporation Confirms Ransomware Group "Qilin" Claims Data Release — BigGo Finance
Photo: Konaine (CC BY-SA 3.0)
