Tokyo Metro Metpo email address breach

On 27 September 2026, Tokyo Metro Co., Ltd. — the operator of one of the world's busiest subway networks — announced that an unauthorised third party had accessed the email addresses of roughly 59,000 customers enrolled in its Metpo loyalty programme. The company said no other personal information was accessed and urged affected members to be alert for possible phishing emails or other scams exploiting the exposed addresses.

The disclosure came the same weekend that fellow Japanese transport operator Keio Corporation confirmed a ransomware attack and car-rental firm Times Car reported a separate intrusion, though it was not established whether the incidents were connected.

What happened

Tokyo Metro said it detected unauthorised access to the system supporting its Metpo membership programme and moved to contain it, identifying the suspected point of entry and taking steps to prevent another incident. The exposure was limited to email addresses; the company stated that no other personal data — such as names, payment details or travel records — was compromised.

Because email addresses alone are enough to fuel targeted phishing, Tokyo Metro cautioned members that they might receive fraudulent messages impersonating the operator and advised against clicking suspicious links or divulging further information.

Impact

• Email addresses of approximately 59,000 Metpo loyalty-programme members were accessed by an unauthorised third party.
• No other personal information was reported as compromised.
• Tokyo Metro identified the suspected entry point, took containment steps, and warned members about potential phishing follow-ups.