[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fnhhqVF1aZF9keKfwyhRUP7slE_N2Oc-RxEIrujNbPnM":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":138},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"0f5a6f2c-a174-4473-82a7-4ad50a251fe8","Japan's Keio confirms ransomware attack disrupted business systems","japan-s-keio-confirms-ransomware-attack-disrupted-business-systems-ccc11f","Keio Corporation (Keio), a major private railway operator in Japan, said its network was hit by a ransomware attack over the weekend, disrupting some of its business systems. [...]","Keio Corporation, a major Japanese railway operator with 85 km of track and 69 stations plus 25 hotels, confirmed a ransomware attack on September 26, 2026 that disrupted business systems, particularly affecting the hospitality division's payment systems. The company reported the incident to police and engaged external experts to investigate the attack's route and scope, including whether customer or business partner data was accessed. A separate cyber incident at Tokyo Metro over the same weekend saw unauthorized access to systems and 59,000 member email addresses, though it remains unclear if both attacks were part of a coordinated campaign.","Keio Corporation, Japan's major railway operator, hit by ransomware attack disrupting hospitality business systems.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fjapans-keio-confirms-ransomware-attack-disrupted-business-systems\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F09\u002F28\u002Ftokyo-train.jpg","2026-09-28T20:56:47+00:00","2026-09-28T22:00:08.834564+00:00",7,[17,20,22],{"name":18,"type":19},"Keio Corporation","vendor",{"name":21,"type":19},"Tokyo Metro",{"name":23,"type":24},"Keio Plaza Hotel Tokyo","product","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":25,"icon":27,"name":28,"slug":29},null,"Ransomware","ransomware",[31,36,41],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":37},{"id":38,"icon":27,"name":39,"slug":40},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":42},{"id":43,"icon":27,"name":44,"slug":45},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",[],[18,21,23],{"controls":49,"vendors":137},[50,79,108],{"slug":51,"name":52,"problem":53,"products":54},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"slug":80,"name":81,"problem":82,"products":83},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[84,92,100],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"slug":109,"name":110,"problem":111,"products":112},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[113,121,129],{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"rubrik","Rubrik","\u002Fvendor-logos\u002Frubrik.png","zero-trust-data-protection","Rubrik Zero Trust Data Protection","https:\u002F\u002Fwww.rubrik.com\u002Fproducts\u002Fdata-protection","Air-gapped, immutable backup for on-premises, cloud and SaaS data, with threat detection in backups and orchestrated recovery.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"veeam","Veeam","\u002Fvendor-logos\u002Fveeam.png","veeam-data-platform","Veeam Data Platform","https:\u002F\u002Fwww.veeam.com\u002Fproducts\u002Fveeam-data-platform.html","Backup and recovery for virtual, physical, cloud and SaaS workloads, with immutable storage options.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"commvault","Commvault","\u002Fvendor-logos\u002Fcommvault.png","commvault-cloud","Commvault Cloud","https:\u002F\u002Fwww.commvault.com\u002Fplatform","Backup and recovery platform with immutable storage and recovery testing.",[],{"slug":139,"title":140,"body":141,"framework_refs":142,"framework_notes":158},"ransomware-hits-japanese-railway-giant-keio-disrupts-hospitality-payment-systems","Ransomware Hits Japanese Railway Giant Keio, Disrupts Hospitality Payment Systems","Keio Corporation suffered a ransomware attack that disrupted business systems — most critically, payment infrastructure within its hospitality division — highlighting the risk of interconnected IT environments across operationally distinct business units. The timing of a simultaneous incident at Tokyo Metro raises concerns about coordinated targeting of Japanese transit operators, a sector that manages both critical infrastructure and large volumes of customer personal and financial data. The fact that investigators are still determining whether customer or partner data was accessed suggests logging and containment capabilities may have been insufficient to provide rapid visibility. Ransomware attacks of this nature typically exploit gaps in network segmentation, allowing attackers to pivot from a single compromised entry point to high-value systems. Organizations managing both critical infrastructure and consumer services must treat cross-divisional lateral movement as a primary threat scenario.",[143,144,145,146,147,148,149,150,151,152,153,154,155,156,157],"CIS Control 3: Data Protection","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","CIS Control 17: Incident Response Management","NIST CSF: RS.CO-2 (Incidents are reported per established criteria)","NIST CSF: PR.AC-5 (Network integrity is protected via network segmentation)","NIST SP 800-61: Computer Security Incident Handling Guide","NIST SP 800-53 IR-4: Incident Handling","NIST SP 800-53 SC-7: Boundary Protection","ISO\u002FIEC 27001:2022 — Annex A 5.26: Response to information security incidents","ISO\u002FIEC 27001:2022 — Annex A 8.22: Segregation of networks","GDPR Article 33: Notification of a personal data breach to supervisory authority","GDPR Article 34: Communication of a personal data breach to data subjects","ITIL 4: Major Incident Management practice","Japan Act on the Protection of Personal Information (APPI) — breach notification obligations",{}]