Two major railway operators in the Tokyo region of Japan have disclosed significant cyber-attacks, although passenger travel remains unaffected.
Tokyo Metro operates some of the capital’s busiest subway lines, carrying over seven million passengers each day.
It said in a statement on September 27 that an unauthorized third party had accessed the email addresses of 59,000 passengers signed up to its Metpo loyalty scheme.
The operator confirmed that it has identified the suspected point of unauthorized access and taken measures to prevent a reoccurrence. Only email addresses were taken, but the company urged customers to “exercise particular caution” regarding possible follow-on phishing attempts.
Read more on threats to railway operators: Ukraine Railway Systems Hit by Targeted Cyber-Attack
The second operator affected, Keio, serves a popular line connecting central Tokyo to suburbs and outlying areas west of the city.
Keio Corporation revealed that a ransomware attack struck on September 26 and that police are currently investigating its extent, “including whether any confidential business information or customer data has been leaked.”
However, the operator appears to have acted swiftly to contain the threat, disconnecting systems from the internet.
“Disruptions have occurred in the sales systems of certain group companies,” it explained. “While we have not confirmed any data leakage at this time, we are continuing our investigation. Please note that there is currently no impact on railway operations.”
The company’s Keio Plaza Hotel was one of the businesses affected.
“Currently, it may take longer than usual to receive a response to inquiries made through the contact form on our official website and through various reservation sites,” it said in a note. “Additionally, depending on the situation, we may not be able to respond to all inquiries.”
Times Car Breach Impacts Millions
It’s unclear whether the Tokyo Metro and Keio security breaches are connected. However, they come at the same time as a third incident impacting a Japanese transport operator.
Car-rental company Times Car announced on September 25 that an unauthorized third party gained access to its website the same day, leading to the compromise of personal information on members and former members.
Exposed information includes names, home and email addresses, dates of birth, membership numbers, driver's license information, identity verification documents, and more.
“Possible leaks of personal information may be misused in phishing emails and other fraudulent activities. Please be cautious of suspicious emails, phone calls, SMS messages, etc., that impersonate our company,” a notice warned.
“Do not open links or attachments in communications you do not recognize, nor enter personal information such as passwords, authentication information, or credit card information. We will never ask for your password or credit card information via email, SMS , or phone.”
The firm said as many as 6.6 million individuals may be impacted. They include current and former members, including Times Business Service members.
Times Car added: “Passwords are stored in a format that cannot be recovered, and there is no risk of customer accounts being misused using this information.”