Tokyo Metro said about 59,000 email addresses registered to its Metro Point Club rewards program may have been viewed or taken after an unauthorized party gained access to one of its servers, MLex reported Sunday. The subway operator’s disclosure came the same weekend that Keio, a Tokyo rail and hospitality group, confirmed a ransomware attack on its business systems.

What Happened

Tokyo Metro announced the incident on Sept. 27, Japan time. The company said the affected server contained only email addresses and no other member information. It said it has taken steps to block further unauthorized access and is still investigating how the intrusion happened and how far it reached.

The operator urged customers to be especially careful about suspicious messages, since a list of verified email addresses tied to a known brand is useful raw material for phishing campaigns that impersonate the company.

RelatedCybersecurity Incident at BAE Systems Halts Notices From U.S. Bankruptcy Courts

Tokyo Metro is publicly listed and partly owned by the Japanese government and the Tokyo Metropolitan Government.

Separately, Keio said it confirmed a ransomware attack on group servers in the early hours of Sept. 26. The attack disrupted sales and payment systems at some group companies. Keio Plaza Hotel Tokyo posted a notice about a system failure caused by the attack and warned of possible delays to some customer-facing services, and local reports said card and electronic-money payments and point accrual were temporarily unavailable at some Keio Store locations. Keio said train operations were not affected.

Why It Matters

Both incidents hit business systems rather than the signaling and control systems that run trains, but they show how rail groups’ sprawling commercial arms widen their attack surface. Keio’s group spans railways, hotels and retail, and the ransomware reached the parts of the business that handle customer payments.

For Tokyo Metro, the exposure is narrow in data terms but broad in reach. Email addresses alone cannot be used to log in to accounts, yet a confirmed list of 59,000 active rewards members gives fraudsters a ready target list for messages that appear to come from the operator.

The two disclosures also fit a wider run of intrusions at Japanese transport and travel companies. Earlier in the week, car-sharing operator Times Car disclosed unauthorized access affecting up to 6.6 million current and former members.

What Remains Unknown

Keio said it had not confirmed any data leak and is investigating whether attackers accessed customer or business partner information. As of Sunday, no ransomware group had publicly claimed the attack. Tokyo Metro has not said how the attacker got in or when the access began.

It is unclear whether the incidents are connected, and neither company has named a suspect.

What to Watch

Tokyo Metro’s investigation should establish whether the intrusion was limited to the email server, and whether members receive phishing messages that use the stolen addresses. For Keio, the key questions are whether a ransomware group lists the company on a leak site, which would suggest data was stolen, and how quickly hotel and store payment systems return to normal.