Summary
- Environment: Online Shop and My docomo procedures
- Operational impact: Customer data leaked; online procedures suspended
- Financial impact: No quantified cost disclosed
- Record status: Developing record. Reviewed November 7, 2026; updated as evidence emerges.
What happened
NTT DOCOMO detected unauthorized external access on November 4 and suspended Online Shop and My docomo procedures around 01:05 JST on November 5. It confirmed customer-information leakage before the emergency maintenance. [1]
Impact
The November 6 notice estimated a maximum of about 300,000 affected records. This is a record estimate, not a confirmed number of distinct people. [1]
Exposed fields included names, birth dates or ages, contact details, identity-document numbers and mobile-contract details. Some records also contained representative, employer, bank-account or child-program information; the fields varied by record. [1]
Timeline
Unauthorized access detected
DOCOMO detected external unauthorized access. Source account.
[1]Online procedures suspended
Online Shop and My docomo procedures were suspended around 01:05 JST. Source account.
[1]Third notice confirms leakage and maximum record estimate
DOCOMO confirmed leakage before maintenance and estimated a maximum of about 300,000 records. Source account.
[1]Briefing updated
This briefing was last reviewed and updated on November 7, 2026.
Threat Group & Attack Vector
DOCOMO identified unauthorized external access but had not established the detailed access path publicly.
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- No specific MITRE ATT&CK technique is currently mapped for this case.
Response
DOCOMO said it had blocked unauthorized access and detected no further leakage. Maintenance continued without an announced restoration time, while the detailed access path and scope remained under investigation. [1]