Japan's largest taxi operator Nihon Kotsu confirms cyberattack that knocked out dispatch systems

Nihon Kotsu, the taxi and chauffeur company with the largest group revenue in Japan, disclosed on July 13, 2026, that intruders gained unauthorized access to its internal systems, infecting them with malware and forcing a shutdown of key booking and dispatch functions.

The company said the breach began in the early hours of July 11, 2026. Once the intrusion was detected, staff moved quickly to cut off affected systems, a measure the company said helped contain the damage. The company’s phone-based taxi dispatch service, its Hire Web ordering and reservation management platform, and portions of its internal networks remain offline.

Nihon Kotsu operates close to 9,000 taxis and hire vehicles, concentrated in Tokyo’s special wards along with the neighboring cities of Musashino and Mitaka, with further reach into the Kanto and Kansai regions through affiliated firms. Group figures put its workforce at 18,228 employees, its taxi fleet at 8,558 vehicles, and its chauffeur fleet at more than 2,000 vehicles, generating annual revenue of roughly $1 billion, or about 155 billion yen.

In a statement, the company said, "We have confirmed that our internal systems were subjected to unauthorized external access (malware infection)." It added, "Immediately after detecting the unauthorized access, we implemented emergency measures, including disconnecting systems to prevent further damage."

Dispatch through the separately operated GO taxi app has not been affected and continues to function normally. Nihon Kotsu is urging customers who need a ride to book through the GO app under the "Nihon Kotsu" listing, or to use taxi stands and street hailing while its own phone and web booking channels remain down.

The disruption has also suspended the company’s "labor taxi" service, which is designed for pregnant women nearing childbirth, across Tokyo, Musashino, Mitaka, Tachikawa, Yokohama and Saitama.

Nihon Kotsu says it has brought in outside cybersecurity specialists to investigate the scope of the intrusion, trace its origin and assist with restoring systems. The company says no leak of data has been confirmed at this stage, though it is continuing to examine that possibility and has pledged to issue further public updates and direct notices to affected customers if new findings emerge.

The company is also warning customers to avoid opening attachments or clicking links in any message that claims to come from Nihon Kotsu but appears suspicious, citing the risk of related fraud attempts. No hacking group or extortion operation had claimed responsibility for the intrusion as of the latest update, and no threat actor has been identified by name.