Nihon Kotsu Co., Ltd. listed on AiLock ransomware leak site

• Ransomware group: AiLock
• Country: Japan
• Sector: Transportation
• Announcement date: July 15, 2026

The AiLock ransomware group has listed the Japan-based transportation company Nihon Kotsu Co., Ltd. on its leak site. This announcement, which appeared on July 15, 2026, marks a new development in the ongoing activity of the threat actor known as AiLock.

The claim by AiLock

The threat actor known as AiLock has announced the institution Nihon Kotsu Co., Ltd. through a post on its leak platform. The listing was created on July 15, 2026. While the group has made this public claim, public information regarding this specific group remains limited, making it difficult for security researchers to establish a comprehensive profile of their typical operations or motivations.

Ransomware leak sites are platforms used by cybercriminals to pressure victims into paying ransoms. In many modern ransomware campaigns, threat actors employ a tactic known as double extortion. This method involves not only encrypting an organization's data to disrupt operations but also stealing sensitive information before the encryption occurs. The threat of leaking this stolen data on a public platform serves as additional leverage to compel the victim to meet the attacker's demands.

Data involved in the claim

At this time, there is no screenshot or detailed information provided on the leak site regarding the nature of the data involved. The listing names no data types.

Organization profile

Nihon Kotsu Co., Ltd. is the largest taxi and limousine operator in Japan. The company provides transportation services with a large fleet of vehicles, making it a significant entity within the Japanese transportation sector.

Potential impact and industry implications

This claim may lead to disruptions in the institution's operational processes and could negatively impact customer trust. Under Japan's Act on the Protection of Personal Information (APPI), the institution may face legal obligations if the breach is confirmed. The potential exposure of data could lead to secondary risks such as targeted phishing attacks or identity theft against customers.

Given the institution's position in the sector, a potential data loss might also affect supply chain security. When a major logistics or transportation provider is targeted, the ripple effects can extend to various partners and service providers within the broader supply chain ecosystem.

The limited information regarding the AiLock group's methods makes it difficult to determine the scope of the threat. For organizations operating in the transportation and logistics sectors, maintaining robust cybersecurity posture is essential to mitigate such risks. Common defensive steps for organizations include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training for employees to recognize phishing attempts. Furthermore, continuous monitoring of network traffic and implementing strict access controls can help detect and contain potential intrusions before they escalate into full-scale data exfiltration events.