TOKYO, October 26, 2026 — Railway operators across Japan have disclosed separate cyber incidents this month, exposing how corporate IT weaknesses are increasingly becoming the gateway for attacks on critical transport networks. The breaches highlight a structural vulnerability where enterprise systems, rather than control technology, serve as the primary entry point for threat actors.
< h2> Corporate IT as the Primary Gateway
Recent disclosures from two of Japan’s largest rail groups illustrate the risk. Keio Corporation, which operates lines serving western Tokyo, confirmed on September 26 that a ransomware attack had caused a system failure across its corporate infrastructure. The incident impacted the broader Keio Group, including Keio Plaza Hotel Tokyo, which reported system delays affecting customer inquiries and reservations. While train operations continued normally and investigators found no immediate evidence of confidential data exposure, the incident demonstrated how a corporate network outage can quickly bleed into customer-facing services.
A day later, on September 27, Tokyo Metro disclosed a separate breach involving unauthorized access to approximately 59,000 email addresses in its loyalty database. The company identified a suspected entry point and implemented remedial measures. However, experts warn that stolen customer records pose long-term phishing risks, in which threat actors exploit travel notifications, refunds or account updates to harvest credentials and gain secondary access to corporate networks. “A large number of attacks on transport operators have started with IT rather than OT systems,” Philip Thomas, a partner in the Tech & Data Group at global law firm Reed Smith, told TechTarget. “Ransomware on corporate networks or breaches of booking and ticketing systems have caused major service disruption without necessarily involving any compromise of the control systems.”
< h2> Scale and Frequency of Transportation Sector Breaches
Data from industry reports underscores the growing threat. Verizon’s 2026 data breach investigations report lists 689 transportation sector security incidents, including 652 with confirmed data disclosure. System intrusion, social engineering and human error accounted for 85% of transportation breaches. Cyberattacks on transportation operators are increasing, making them among the most targeted sectors in ENISA’s 2026 threat landscape report.
The Keio and Tokyo Metro incidents, while differing in scope, both illustrate the challenges facing chief information security officers responsible for protecting interconnected enterprise systems, customer information and essential transportation services. Railway and critical infrastructure operators manage a complex mix of enterprise information technology (IT) and operational technology (OT), each governed by vastly different availability, safety and recovery requirements. This intersection creates a broad attack surface where a single vulnerability in a corporate network can have ripple effects across an entire transport system.
< h2> The Intersecting IT and OT Challenge
Railways rely on a dual-layer architecture. Operational technology controls the physical movement of trains, signaling and track switching, requiring extreme reliability and safety certifications. Enterprise IT handles scheduling, customer booking, payroll and communications. The two systems are interconnected, often for operational efficiency, but they operate under fundamentally different risk profiles.
Investigators found no immediate evidence of confidential data exposure during the Keio ransomware incident, but the breach still disrupted hotel reservation systems within the group. Tokyo Metro’s breach targeted customer data directly, compromising email addresses but leaving train control systems untouched. The distinction highlights a critical reality: threat actors frequently exploit the IT layer—where security hygiene may be less rigorous than in OT environments—to reach their objectives. A large number of attacks on transport operators start with IT rather than OT systems, according to legal and tech experts. This pattern forces operators to secure not only the tracks and signals but also the business systems that support daily operations.
< h2> Implications for Infrastructure Protection
The incidents in Tokyo this month serve as a case study in the expanding scope of cyber risk across the transportation sector. While corporate IT systems and customer databases often bear the immediate brunt of an intrusion, these entry points create direct operational, financial and safety risks across interconnected transportation networks. For chief information security officers, the path forward requires bridging the gap between IT security teams and operational technology managers. The goal is to ensure that a breach in a booking system or email server does not become the catalyst for a broader disruption of rail services. As cyberattacks on transportation operators continue to rise, the vulnerability of enterprise IT within critical infrastructure has become a central concern for regulators and operators alike.
The Unfinished Architectural Vision
There is a critical gap in the current security architecture of major rail groups. While Keio Corporation has successfully isolated affected networks and launched investigations with external specialists following its ransomware attack, the broader structural separation between infrastructure management and transport operations remains incomplete for many entities globally.
Historical precedents illustrate the dangers of an unseparated entity. The Polish State Railways (PKP) underwent a significant reform in 2001 when the former state-owned enterprise was divided into several units specifically based on the need for separation between infrastructure management and transport operations. This restructuring created a holding company structure where PKP S.A. maintains 100% share control over all component companies, including passenger operators like PKP Intercity and freight carriers such as PKP Cargo.
Despite this historical precedent for separation, the modern Japanese incidents highlight that even when operational technology controls physical movement and enterprise IT handles scheduling or customer booking, the two systems remain interconnected for efficiency. This interconnection creates a broad attack surface where vulnerabilities in corporate networks, such as those at Keio Plaza Hotel Tokyo, can quickly bleed into other parts of the group’s operations without necessarily compromising train control systems.
The challenge facing chief information security officers is ensuring that breaches in business systems do not become catalysts for broader disruptions. As cyberattacks on transportation operators continue to rise, making them among the most targeted sectors in ENISA’s 2026 threat landscape report, the industry must address the reality that a majority of attacks start with IT rather than OT systems. The goal remains to secure not only the tracks and signals but also the business systems that support daily operations without creating new points of failure.
Sources
- Off the rails: Railway cyberattacks highlight infrastructure risks | TechTarget
- Polish State Railways
- Off the rails: Railway cyberattacks highlight infrastructure risks | TechTarget
Photo: MaedaAkihiko (CC BY-SA 4.0)
