Keio says trains ran, but customer forms went unreadable at least seven hours before it confirmed the attack

The forms stopped before the attack was confirmed

On 28 September, Keio Corporation told customers that anyone who applied for a group ticket, the Keio Liner private-room plan or its Keio Location Service by form or e-mail after 17:00 on Friday 25 September should apply again by telephone, because Keio cannot see those applications (Keio's notice, in Japanese). Its ransomware notice says the attack was confirmed in the early hours of Saturday 26 September. The early hours cannot begin before midnight, so the window of applications Keio asks customers to repeat opens at least seven hours before its confirmation of the attack. That is our arithmetic: 17:00 to 24:00.

What that does not establish is most of the story. It does not say when anyone got into the network, when any server was encrypted, or why 17:00 is the line. The time could mark the start of the intrusion, the last point at which a mail or form queue was intact, or the moment something was cut off. Keio does not say which, and nothing else I could read does either. What it does show is that the date on the press notice and the moment customers began to be affected are two different clocks.

The version most readers will have seen is shorter: a Japanese railway was hit by ransomware and the trains kept running. The second half is Keio's own statement, and it is the least useful half for anyone who does business with the group.

Which Keio this is, and how it was read

The notice comes from 京王電鉄株式会社, which Keio's own site and its hotel subsidiary's English page call Keio Corporation. It is the parent of a Tokyo-area railway group. Nikkei xtech lists five business lines: transport, property, hotels, construction and building services, and lifestyle services (my translation). It is not Keio University, a separate institution with a different name in Japanese (慶應, not 京王), and no source I read connects the two. If you match supplier names in a threat feed, a rule on the romanisation "Keio" will catch both.

Eight group companies, each describing its own failure

Keio's first notice names no company. It says the business systems of "some group companies" are affected (my translation of 一部グループ会社の営業システム). The picture came together over the next two days from each company's own site. I found notices from eight group companies, the parent included, and there may be more.

What each Keio group company's own notice says has stopped, and what it says continued. Sources: the companies' own notices, read 29 September 2026. Translations are ours.

Company and notice	Stopped or unreadable	Said to continue
Keio Corporation, 26 and 28 Sept	Contact form entries. Group ticket, Keio Liner private room and Keio Location Service applications by form or e-mail after 17:00 on 25 Sept: phone only.	Train operations: "no impact at present".
Keio Plaza Hotel, 26 Sept	Some systems. Website form and booking-site inquiries may be slow or go unanswered.	Hotel operations: no impact at this time.
Keio Plaza Hotel Sapporo, 28 Sept	Keio Group Points. E-mail replies may be slow.	Existing bookings and restaurants.
Keio Presso Inn, 26 to 28 Sept	New bookings. E-mail inquiries, including earlier ones. Self check-in machines, smart TV and Wi-Fi.	Existing bookings honoured. Front-desk check-in, slower than usual.
Keio Department Store, 28 Sept	Card payments and points at some floors since the morning of 26 Sept. All procedures at the Tomo-no-Kai customer-club counter.	Not stated beyond "some floors".
Keio Store, 27 Sept	Keio Points. Cards and e-money at some stores. Inquiry e-mail. Up-to-date website leaflets.	Rakuten Points still work.
Keio Bus, 26 Sept	Credit cards at commuter-pass counters.	Cards at Keio line ticket machines.
Keio Real Estate, 26 Sept	Replies to inquiries and repair arrangements are slower than usual.	Not stated. The notice names no cause.

Two things the table cannot show. First, scope by count: Keio's press office told Nikkei xtech on 28 September that the attack hit two places, the group's servers and Keio Plaza Hotel's servers. That is second-hand, it is the only count anyone has given, and it leaves open which companies sit on the group servers. Nikkei xtech adds that Keio is still checking the order in which the two were reached. Second, the Keio Real Estate notice does not mention ransomware. It is in the table because Nikkei xtech and the group's other notices place it inside this incident, and I have not confirmed that from the company itself.

Systems disrupted is not customers unaffected

Three comforting phrases carry the first notice. "System failure" is the label in the title, and it describes the servers, not what a customer lost. "Business systems of some group companies" covers, in the companies' own words, card payments, loyalty points, hotel bookings, commuter-pass sales, customer-club counters, repair arrangements and inbound e-mail. And "no impact on train operations at present" is true on Keio's word, and is the sentence most readers carry away, although the railway company's own notices of 28 September ask customers to phone instead of applying by form.

BleepingComputer's report adds a framing that the group's pages do not support: it says the incident "appears to have affected only the hospitality side" of Keio's business. The hotels are three of the eight companies. The department store, the supermarket chain, the bus company, the property company and Keio Corporation's own forms are the other five. Where the article and the companies disagree, this briefing follows the companies.

The pattern across them is not about ransomware in particular. Shared services failed together. Keio Points stopped at Keio Store, Kitchen Court and Matsumotokiyoshi stores (some excepted), while Rakuten Points, an outside scheme, kept working; points are also reported down at some department store floors and at the Sapporo hotel. Card payments failed at some stores and at the bus company's counters but not at the railway's ticket machines. Six of the eight describe trouble with inbound inquiries, from delayed replies to mail the company cannot read.

Keio says it isolated the network to stop the spread. It does not say which failures are encrypted servers and which are systems it switched off itself. That is inference territory, and from outside the two cannot be told apart. For a customer at a till it makes no difference. For a defender it does: isolation is a choice, so the manual fallback for whatever it takes down is something you can decide before the night you need it.

What kept most customers moving was manual fallback, and it is visible in the notices. Applications went to a telephone line at the railway's sales department. Presso Inn moved check-in and check-out to the front desk. Keio Store asked shoppers to keep receipts for purchases that earned no points, with the method for adding them to follow recovery. Whether these fallbacks were planned or improvised the notices do not say. A group that has decided in advance what runs by phone, paper and cash can cut a network and stay open. One that has not will cut it anyway.

The most transferable failure is the quietest one. Presso Inn says it cannot see inquiries sent before the failure, not only new ones. Keio Store says it cannot see inquiry e-mail. Keio Corporation says applications by form or e-mail cannot be confirmed. None of the notices says whether senders saw an error. If they did not, a customer who wrote on Friday evening to cancel, to complain or to ask for their data has a sent message and no reader, and the sender's side looks normal. An inbound channel that fails without telling the sender is easy to leave off a risk register.

What the record does not establish

What Keio's notices state and what they leave out. Sources: Keio Corporation, Keio Plaza Hotel and group company notices, 26 to 28 September 2026; Nikkei xtech for the two points attributed to Keio's press office.

Question	On the record	Not on the record
Who was hit	Keio Corporation: "the group's servers". Keio Plaza Hotel: its own servers.	Which companies share the group servers. The order of the two compromises, still being checked (Nikkei xtech).
When	Confirmed in the early hours of 26 Sept. Applications unreadable from 17:00 on 25 Sept.	A clock time for the confirmation. When access began. What 17:00 marks.
Data	Keio cannot currently confirm any leak of business or customer information, and is investigating.	Whether any data was taken. Not confirmed is not none.
Ransom	Keio's press office told Nikkei xtech at noon on 28 Sept that no demand was confirmed.	Anything on a Keio page. Whether a demand has arrived since.
Who did it	Nothing in any Keio notice. BleepingComputer found no group claiming it when it wrote.	Any claim I could read. One social-media aggregator post appeared in search and I could not open it.
Encryption	"Ransomware attack" and "system failure".	Which servers, and how many, were encrypted. The word does not appear in the ten notices from eight companies that I read.
Recovery	Keio Store, 27 Sept: recovery time undecided. Presso Inn: bookings suspended for the time being.	A date from any company. No page read on 29 Sept reports recovery.

On a group claim: BleepingComputer says it could not find one when it published. I found none in anything I could read, and I could not open the one social-media aggregator post about Keio that turned up in search, so I cannot say what it says. If a group does claim Keio, treat the name as a label rather than a scope. The same affiliates work under several brands, as our briefing on Storm-2570 sets out, and a claim is an allegation by a party that wants leverage.

What a UK organisation with Japanese subsidiaries or suppliers should check

Method and interest

Every fact about the incident comes from the companies themselves or from Nikkei xtech quoting Keio's press office. The companies have a reputational and legal interest in cautious wording, and their notices are cautious: where they name a cause it is ransomware, none says the systems were encrypted, and none says data is safe. News outlets do not share that interest, but they are working from the same notices. Aggregator sites I looked at repeat BleepingComputer and add nothing I could check, so I did not use them.

The question that exposes the gap

Ask your own incident lead one question. If you cut your network off at two o'clock on a Saturday morning, which of your customers could still reach you on Monday, by which channel, and who would be reading what they sent?

Keio says its trains ran. Everything customers use to book, pay, ask and apply is what the group had to answer for on the day.

Key facts