2026 Tokyo Metro — ~59,000 rewards-member email addresses via unauthorized server access
Data compromised
About 59,000 email addresses of rewards-program members. Company says the breached server did not store other personal information.
Technical writeup
Verified operator disclosure — Tokyo Metro announced ~59,000 rewards-program member email addresses may have been compromised via unauthorized access to a server, discovered during investigation of Sep 20, 2026 email delivery errors. Company states the server held only email addresses, the weakness was closed, and access was believed to originate overseas. Same weekend as Keio ransomware; no public evidence of a coordinated campaign. recordsAffected 59000; companyConfirmed true.
Root cause
Unauthorized access to a server (believed overseas origin) found while investigating Sep 20 email delivery errors; vulnerability closed (Tokyo Metro / Kyodo).