Japan's biggest taxi firm Nihon Kotsu hit by malware, dispatch system still down

Key points

• Nihon Kotsu, Japan's largest taxi operator with roughly ¥155 billion (about $1 billion) in annual revenue, detected an intrusion early Saturday morning.
• The company pulled car hire, web booking, reservation management and phone dispatch offline; all remain unavailable.
• A specialist service ferrying pregnant women near their due date is suspended across Tokyo, Musashino City, Mitaka City, Tachikawa, Yokohama and Saitama.
• Nihon Kotsu says outside cybersecurity experts are helping investigate, and it has not confirmed whether customer data was stolen.
• No ransomware group has claimed responsibility as of publication.

Japan's largest taxi and chauffeur operator, Nihon Kotsu, says criminals broke into its internal systems over the weekend, forcing it to shut down large parts of its booking and dispatch operation.

The company detected the intrusion in the early hours of Saturday morning. It describes the event as "unauthorized external access (malware infection)", meaning malicious software planted on its network from outside. The incident was first reported by BleepingComputer.

Nihon Kotsu is not a small target. The firm employs 18,228 people, runs 8,558 taxis and operates more than two thousand chauffeur vehicles.

In a public statement, the company said it disconnected affected systems as an emergency measure to stop the damage spreading. That means customers can't use the usual channels to hail a car. The firm is telling customers to book through the 'GO' taxi app or walk to a nearby taxi stand and flag down a vehicle in person.

What does this mean for ordinary customers?

If you had a booking, it's probably not in the system. The most disruptive suspension is the company's "labor taxi" service, a pre-arranged ride for pregnant women close to giving birth, paused across six areas: Tokyo, Musashino City, Mitaka City, Tachikawa, Yokohama and Saitama. Affected families will need to arrange alternative transport.

Nihon Kotsu has also warned customers to be careful with their inboxes. Criminals often follow a breach by sending fake emails that look like they come from the affected company, a tactic known as phishing, where scammers try to trick recipients into clicking a link or opening a file. The company's advice: don't open attachments or click links in unexpected messages claiming to be from Nihon Kotsu.

Was customer data stolen?

Nihon Kotsu says it doesn't know yet. The investigation is ongoing, and the firm has promised to notify affected customers individually if evidence of a data leak emerges. External cybersecurity specialists are helping.

No ransomware gang has claimed the attack so far. That silence isn't unusual in the first days after an incident. Extortion groups often wait a week or more before naming a victim publicly, giving private negotiations time to play out.

This attack lands against a backdrop of sustained pressure on Japanese digital infrastructure. We covered KDDI's breach of 12.2 million customer records on 9 July, just weeks before this incident.

For security teams watching this space, the pattern is worth noting. A company of this scale, with dispatch operations running around the clock, taking systems fully offline is a significant operational call. It suggests the malware had spread far enough that a clean boundary couldn't be drawn around it.

For now, the practical picture is straightforward. Nihon Kotsu can still put cars on the road. It just can't take bookings the way it usually does. Anyone waiting on a reservation should assume it needs to be remade through the GO app or at a taxi stand, and any unsolicited message referencing the company should be treated as suspect until normal service is restored.