Malware Strands Japan's Largest Taxi Fleet, Nihon Kotsu

Nihon Kotsu, the largest taxi and chauffeur operator in Japan, spent the weekend quietly unplugging bits of its own network after finding malware inside. The intrusion was spotted early on Saturday. Days later, the company's dispatch platform is still offline.

The scale is what makes this one land. Nihon Kotsu runs 8,558 taxis and more than 2,000 chauffeur cars, and pulls in roughly $1 billion in annual revenue. When its systems went down, so did car hire, web bookings, reservation management and the phone dispatch service. Customers are being pointed at the third-party GO app or told, essentially, to walk to a taxi rank and hope.

A digital problem with very physical consequences

The knock-on effects have not stayed inside a data centre. The company's dedicated service that ferries pregnant women to hospital has been suspended in Tokyo, Yokohama, Saitama and several other areas. That is not a minor line item in a press release. It is a service people rely on at moments when calling a normal cab feels like too much to organise.

Nihon Kotsu says it detected the malware, disconnected the affected systems to stop it spreading, and called in outside investigators. Whether any customer or driver data has been taken is still an open question. No ransomware group has stepped forward to claim the attack, which either means the negotiation is happening quietly or the intrusion is something else entirely.

Customers have been warned to ignore suspicious emails or links claiming to come from Nihon Kotsu while the investigation continues, which is a fair bet given how often attackers use the confusion around a public incident to run a second wave of phishing at the same audience.

Cars ready, drivers ready, software not

The detail worth sitting with is how fast a purely digital problem became a physical one. There are thousands of cars in the fleet. There are drivers turning up for shifts. There are people trying to get to work, to appointments, to hospitals. None of that stopped because of a broken engine or a shortage of fuel. It stopped because the software that matches a passenger to a car could not be trusted to run.

That is the shape of a lot of modern operational risk. The physical business looks the same as it did twenty years ago, but the connective tissue is now code. Take out the code, and the physical business seizes up in a way that no amount of extra cars or extra drivers can fix.

The company has not put a timeline on full recovery. Investigations of this kind rarely move quickly, especially when the priority is confirming what got in, what it touched, and whether it left anything behind. In the meantime, Japan's biggest taxi operator is running on manual, and a rival app is quietly having a very good week.