{"id":921,"date":"2026-07-14T15:00:38","date_gmt":"2026-07-14T09:30:38","guid":{"rendered":"https:\/\/www.hexnode.com\/threat-watch\/?p=921"},"modified":"2026-08-19T12:05:16","modified_gmt":"2026-08-19T06:35:16","slug":"nihon-kotsu-cyberattack","status":"publish","type":"post","link":"https:\/\/www.hexnode.com\/threat-watch\/nihon-kotsu-cyberattack\/","title":{"rendered":"Nihon Kotsu Cyberattack Disrupts Japan’s Largest Taxi Operator After Malware Incident"},"content":{"rendered":"

The Nihon Kotsu cyberattack highlights the importance of rapid containment, business continuity planning, and endpoint visibility when responding to malware incidents that affect operational systems.<\/p>\n

Incident at a Glance<\/strong><\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Item<\/span><\/b>\u00a0<\/span><\/td>\nDetails<\/span><\/b>\u00a0<\/span><\/td>\n<\/tr>\n
Organization<\/span><\/b>\u00a0<\/span><\/td>\nNihon Kotsu<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Industry<\/span><\/b>\u00a0<\/span><\/td>\nTransportation<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Country<\/span><\/b>\u00a0<\/span><\/td>\nJapan<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Scale<\/span><\/b><\/td>\nApproximately US$1 billion in annual revenue, 18,000+ employees, and 10,000+ vehicles across the group
\n<\/span><\/td>\n<\/tr>\n
Incident Type<\/span><\/b>\u00a0<\/span><\/td>\nMalware incident<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Initial Access<\/span><\/b>\u00a0<\/span><\/td>\nNot disclosed<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Malware Family<\/span><\/b>\u00a0<\/span><\/td>\nNot disclosed<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Threat Actor<\/span><\/b>\u00a0<\/span><\/td>\nUnknown<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Data Leak<\/span><\/b>\u00a0<\/span><\/td>\nNot confirmed<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Ransomware<\/span><\/b>\u00a0<\/span><\/td>\nNot confirmed<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Operational Impact<\/span><\/b>\u00a0<\/span><\/td>\nDispatch, reservation, and some internal systems disrupted<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Investigation<\/span><\/b>\u00a0<\/span><\/td>\nOngoing<\/span>\u00a0<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

<\/h2>\n

<\/h2>\n

What Happened in the Nihon Kotsu Cyberattack?<\/h2>\n

Nihon Kotsu, Japan’s largest taxi operator by group revenue, has confirmed a cybersecurity incident involving unauthorized external access and a malware infection affecting parts of its internal environment.<\/p>\n

The incident was detected during the early hours of July 11, 2026. As an immediate containment measure, Nihon Kotsu disconnected systems and isolated its internal network while launching an investigation with an external cybersecurity organization.<\/p>\n

The disruption affected several customer-facing and internal services, including telephone-based taxi dispatch, chauffeur-service web ordering and reservation management, and some internal systems. The taxi dispatch system remained offline at the time of publication.<\/p>\n

Nihon Kotsu also advised customers to remain cautious of suspicious emails or messages claiming to originate from the company, particularly those containing unexpected links or attachments.<\/p>\n

The company is investigating whether any information may have been exposed but stated that no data leak had been confirmed at the time of publication.<\/p>\n

How the Incident Unfolded<\/h2>\n

Based on Nihon Kotsu’s public disclosure, investigators have confirmed the following as of publication:<\/p>\n