Off the rails: Railway cyberattacks highlight infrastructure risks

Recent cybersecurity incidents involving Japanese rail operators underscore the expanding scope of cyber risk across the transportation sector. While corporate IT systems and customer databases often bear the immediate brunt of an intrusion, these entry points create direct operational, financial and safety risks across interconnected transportation networks.

Keio Corporation disclosed a ransomware attack that disrupted business systems across parts of its corporate group, while Tokyo Metro reported unauthorized access to email addresses belonging to loyalty program members.

Cyberattacks on transportation operators are increasing, making them among the most targeted sectors in ENISA's 2026 threat landscape report. Verizon's 2026 data breach investigations report lists 689 transportation sector security incidents, including 652 with confirmed data disclosure. System intrusion, social engineering and human error accounted for 85% of transportation breaches.

Although the incidents at Keio and Tokyo Metro differed in scope and impact, both illustrate the challenges facing CISOs responsible for protecting interconnected enterprise systems, customer information and essential transportation services.

Ransomware, data leaks hit Japanese railways

Keio Corporation, a private railway operator serving western Tokyo, confirmed on September 26 that a ransomware attack had caused a system failure across its corporate infrastructure. The organization isolated affected networks and launched an investigation with external specialists.

The impact extended to the broader Keio Group, including Keio Plaza Hotel Tokyo, which reported system delays affecting customer inquiries and reservations.

While train operations continued normally and investigators found no immediate evidence of confidential data exposure, the incident highlighted how corporate IT outages can quickly bleed into customer-facing operations.

A day later, on September 27, Tokyo Metro disclosed a separate breach involving unauthorized access to approximately 59,000 email addresses in its loyalty database. The company identified a suspected entry point and implemented remedial measures.

However, experts warn that stolen customer records pose long-term phishing risks, in which threat actors exploit travel notifications, refunds or account updates to harvest credentials and gain secondary access to corporate networks.

"A large number of attacks on transport operators have started with IT rather than OT systems," Philip Thomas, a partner in the Tech & Data Group at global law firm Reed Smith, told TechTarget. "Ransomware on corporate networks or breaches of booking [and] ticketing systems have caused major service disruption without necessarily involving any compromise of the control systems."

How corporate IT vulnerabilities create OT risks

Railways and critical infrastructure operators manage a complex mix of enterprise information technology (IT) and operational technology (OT), each governed by vastly different availability, safety and recovery requirements.

Almog Apirion, CEO and co-founder of Cyolo, a security company specializing in OT and cyber-physical systems for critical infrastructure, noted that transportation operators face unique hurdles due to legacy OT, geographically distributed infrastructure and heavy reliance on third-party maintenance vendors.

"In transportation, a successful attack can do more than compromise data or disrupt business operations," Apirion said. "It can interrupt essential services, affect thousands of passengers and potentially put public safety at risk."

He added: "A compromise in one environment can potentially create risks for the other, making it critical to secure connections and prevent threats from spreading between systems."

John Pavolotsky, partner at Stoel Rives and co-chair of the firm’s AI, Privacy & Cybersecurity Group, warned that compromised employee accounts or business applications can provide remote-access paths or trusted connections into operational environments when IT and OT are insufficiently segmented.

"An attacker could potentially disrupt signaling, train control, dispatch, maintenance, or other safety-related systems, although the impact depends on system architecture and safeguards," Pavolotsky said.  

Standing privileges, poorly controlled remote access and active accounts from former employees or contractors create high-risk entry points.

Securing identity boundaries across connected infrastructure

These interdependencies extend across the broader infrastructure landscape, including ports, airports and utilities. Recent U.S. GAO reviews found that aviation cybersecurity governance, FAA strategy implementation and threat detection goals were not fully met.

Thomas pointed out that the consequences of an attack on critical infrastructure go beyond inconvenience, business disruption and financial loss. "In transportation, an attack can stop people and goods from moving, disrupt navigational systems, block or delay supply chains and endanger the health and safety of individuals."

As transportation assets evolve, identity management is becoming the primary operational perimeter. Guiseppe Serio with AI security company Upstream warned that emerging connected infrastructure introduces new exposure vectors.

"As trains, cars, robots, drones and industrial machines are increasingly controlled through cloud accounts, APIs, and increasingly AI-powered systems and agents, whoever owns the account owns the machine," Serio said.

Richard Livingston is an editor for TechTarget Cybersecurity, covering news, trends and analysis. Livingston's professional background includes editorial positions in the national defense industry covering the U.S. Army Medical Department, as well as offensive and defensive cyber strategy for military and government audiences.