Washington Hotel (Japan) Investigating Ransomware Attack

Key facts: WHG Hotels data breach

• Date reported: February 16, 2026.
• Unauthorized access identified: February 13, 2026.
• Target entity: Washington Hotel (whg-hotels.jp), operated by Fujita Kanko Inc.
• Source of breach: Unknown, unauthorized third-party (ransomware attack).
• Data types: Internal business data; customer loyalty program ("Washington Net") data is stored separately and remains unaffected.
• Status: Confirmed; internal servers were disconnected to contain the threat after unauthorized access was detected at 10:00 PM on February 13.
• Severity: Medium; while customer personal data appears safe, the attack disrupted internal business operations and caused temporary unavailability of credit card terminals.

Start continuous breach monitoring with UpGuard.

What happened in the WHG Hotels data breach?

Washington Hotel (Japan), operating under the domain global.whg-hotels.jp, disclosed a ransomware attack on February 16, 2026. The incident, which was first detected on February 13, 2026, involved unauthorized access to the company's servers. No specific threat actor has been identified as the perpetrator of this attack.

The company responded by disconnecting affected servers to contain the threat. While business data was accessed, current investigations suggest that customer information remains secure due to its storage on separate systems. The incident is classified as medium severity because it primarily impacted internal operations and specific hardware like credit card terminals. Such incidents typically carry risks of operational downtime and potential data exposure if containment is incomplete.

Who is behind the incident?

The attacker or cause of the incident has not been identified.

Impact and risks for WHG Hotels customers

For customers and partners, the primary risks associated with this ransomware attack include potential service disruptions and temporary issues with payment processing at physical locations. Although the company indicated customer data is stored separately, there remains a possibility of credential abuse or phishing attempts if any contact information was inadvertently accessed during the server breach.

Typical outcomes of ransomware include financial losses and reputational damage; however, proactive isolation of servers can mitigate these effects. Customers should monitor their financial statements for unusual activity and remain cautious of unsolicited communications. Transparency in reporting such incidents is a critical step in maintaining user trust and security.

How to protect against similar security incidents

Scan your domain for vulnerabilities in minutes

Frequently asked questions

What happened in the WHG Hotels security breach?

On February 16, 2026, whg-hotels.jp (global.whg-hotels.jp) disclosed a security breach. According to initial reports, the Washington Hotel brand in Japan suffered a ransomware attack that compromised its servers on February 13, leading to the disconnection of systems to prevent further spread.

When did the WHG Hotels breach occur?

The whg-hotels.jp breach was publicly reported on February 16, 2026. The exact date of the attack has not been disclosed.

What data was exposed?

The types of data involved in the whg-hotels.jp incident have not been disclosed. This page will be updated as verified information becomes available.

Is my personal information at risk?

If you interacted with whg-hotels.jp, there's a possibility your personal information could be affected. Similar incidents often involve email addresses, login details, or financial records. Stay alert for updates and take precautionary measures to secure your accounts.

How can I protect myself after this data breach?

• Change your account passwords immediately
• Enable multi-factor authentication (MFA)
• Monitor your financial accounts for unauthorized charges
• Be wary of phishing emails or suspicious calls
• Utilize data breach monitoring services

What steps should companies take after being impacted by this breach?

Companies typically secure compromised systems, notify affected parties, and provide guidance on protective actions. They also review existing security measures and deploy attack surface management tools to prevent future incidents.