Two Tokyo Railway Operators and a Car-Rental Firm Report Weekend Cyber Incidents

Three separate cybersecurity incidents affecting Japanese transport-related organisations were disclosed in late September. Tokyo Metro reported unauthorized access to email addresses for its Metpo loyalty scheme. Keio Corporation said a ransomware attack disrupted some business systems and affected its hotel subsidiary's customer contacts. Car-rental firm Times Car warned that an intruder accessed its website and exposed personal information for millions of members.

What happened — operator-by-operator

• Date disclosed: statement on Sept 27.
• Impact: email addresses of 59,000 Metpo loyalty scheme members were accessed by an unauthorized third party.
• Company response: identified suspected point of unauthorized access and implemented measures to prevent recurrence. Only email addresses were confirmed taken. Customers were urged to be vigilant for phishing attempts.

• Incident date: ransomware detected on Sept 26.

• Investigation: police are investigating the incident, including whether any confidential business information or customer data leaked. Keio says it has not confirmed any data leakage to date.

• Incident date: unauthorized website access on Sept 25.

• Security detail: passwords are stored in a format the company says cannot be recovered, and it states there is no risk of accounts being misused using password data. The company warned customers about increased phishing attempts and reminded them the firm will never request passwords or credit card details by email, SMS, or phone.

• Operational continuity: both railway operators reported no disruption to train services. The main operational impact reported so far relates to sales and customer contact systems.
• Follow-on fraud and phishing: exposed contact details and identity documents increase the risk of targeted phishing, impersonation, and other social-engineering attacks. Companies involved issued alerts urging caution.
• Unclear connections: there is no confirmed evidence tying these three incidents together.

Concrete steps for affected customers

• If you are a Times Car member, follow the company's official guidance and check which personal fields may have been exposed.
• Change reused passwords and enable multi-factor authentication on accounts where available.