# The trains were on another network

2026-09-26

Keio confirmed ransomware on group servers before dawn on 26 September. Card payments and a hotel booking system failed. The railway control network was separate, and the trains kept running.

Canonical: https://www.fabiocti.com/notes/the-trains-were-on-another-network/
Author: Fabio Correia

The outage people will photograph is the one that is not the railway.

Keio Electric Railway said it confirmed a ransomware attack on group servers in the small hours of 26 September, cut networks to stop the spread, and called the police. Some group companies’ business systems are down. As of the notice, they had not confirmed a leak of confidential business material or customer information, and they said railway operations were not affected. Kyodo reported card payments failing at some group retail shops. Yomiuri, early on the 27th, added that a hotel reservation system run by a subsidiary was unusable, and that the railway servers sit on a separate network. Asked whether a ransom was actually demanded, the company said it would not go into detail.

No group has been named. “No leak confirmed” is the state of the investigation this morning, not a finding that nothing was copied.

## Why the timetable is the wrong dashboard

A train that leaves on time is evidence about the control system that was not on that server. It is not evidence about the till, the booking engine, or the customer file behind the hotel. People will brief “transport was fine” and skip the payment terminal that could not take a card.

Isolation after the fact is containment. It does not say how long the other network was readable before the cut. The question for counsel is the same as any other ransomware morning: is there an object, and is it yours. The question for operations is which system was allowed to share a password, a domain, or a flat route with the one that got encrypted.

## What to pull if the service you depend on is the side door

Not the departure board. The payment path, the reservation database, and whatever identity those systems stored. Treat “trains are running” as a scope statement about one network. Treat the shops and the hotel as in scope until someone shows they were not.

The separation is what saved the timetable. The absence of that separation is what the next operator will not have.