---
title: "NTT DOCOMO Online Shop and My docomo data incident"
description: "NTT DOCOMO confirmed customer-information leakage and suspended Online Shop and My docomo procedures while investigating the scope."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-11-07"
canonical_url: "https://www.ally.security/incidents/ntt-docomo-online-shop-my-docomo-data-incident-2026"
markdown_url: "https://www.ally.security/incidents/ntt-docomo-online-shop-my-docomo-data-incident-2026.md"
stix_url: "https://www.ally.security/incidents/ntt-docomo-online-shop-my-docomo-data-incident-2026/stix.json"
---

# NTT DOCOMO Online Shop and My docomo data incident

NTT DOCOMO confirmed customer-information leakage and suspended Online Shop and My docomo procedures while investigating the scope.

Last modified Nov 7, 2026 · 1 source

## Summary

- **Environment:** Online Shop and My docomo procedures
- **Operational impact:** Customer data leaked; online procedures suspended
- **Financial impact:** No quantified cost disclosed

## What happened

[NTT DOCOMO](https://www.docomo.ne.jp/) detected unauthorized external access on November 4 and suspended Online Shop and My docomo procedures around 01:05 JST on November 5. It confirmed customer-information leakage before the emergency maintenance. [1](#source-1)

## Impact

The November 6 notice estimated a maximum of about 300,000 affected records. This is a record estimate, not a confirmed number of distinct people. [1](#source-1)

Exposed fields included names, birth dates or ages, contact details, identity-document numbers and mobile-contract details. Some records also contained representative, employer, bank-account or child-program information; the fields varied by record. [1](#source-1)

## Timeline

### November 4, 2026 — Unauthorized access detected

DOCOMO detected external unauthorized access. [Source account](https://www.docomo.ne.jp/info/notice/page/261106_00_m.html). [1](#source-1)

### November 5, 2026 — Online procedures suspended

Online Shop and My docomo procedures were suspended around 01:05 JST. [Source account](https://www.docomo.ne.jp/info/notice/page/261106_00_m.html). [1](#source-1)

### November 6, 2026 — Third notice confirms leakage and maximum record estimate

DOCOMO confirmed leakage before maintenance and estimated a maximum of about 300,000 records. [Source account](https://www.docomo.ne.jp/info/notice/page/261106_00_m.html). [1](#source-1)

### November 7, 2026 — Briefing updated

This briefing was last reviewed and updated on November 7, 2026.

## Threat Group & Attack Vector

DOCOMO identified unauthorized external access but had not established the detailed access path publicly.

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

DOCOMO said it had blocked unauthorized access and detected no further leakage. Maintenance continued without an announced restoration time, while the detailed access path and scope remained under investigation. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/ntt-docomo-online-shop-my-docomo-data-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### DOCOMO Online Shop and My docomo unauthorized access: third notice

official · NTT DOCOMO · Nov 6, 2026

<https://www.docomo.ne.jp/info/notice/page/261106_00_m.html>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   NTT DOCOMO Online Shop and My docomo data incident: The November 6 notice estimated a maximum of about 300,000 affected records. This is a record estimate, not a confirmed number of distinct people.
2. **Affected Organization · 100% confidence · current**  
   NTT DOCOMO Online Shop and My docomo data incident: NTT DOCOMO, Inc.
3. **Resulted In · 100% confidence · current**  
   NTT DOCOMO Online Shop and My docomo data incident: Exposed fields included names, birth dates or ages, contact details, identity-document numbers and mobile-contract details. Some records also contained representative, employer, bank-account or child-program information; the fields varied by record.
4. **Occurred At · 100% confidence · current**  
   Third notice confirms leakage and maximum record estimate: 2026-11-06
5. **Resulted In · 100% confidence · current**  
   NTT DOCOMO Online Shop and My docomo data incident: Third notice confirms leakage and maximum record estimate
6. **Resulted In · 100% confidence · current**  
   NTT DOCOMO Online Shop and My docomo data incident: Online procedures suspended
7. **Resulted In · 100% confidence · current**  
   NTT DOCOMO Online Shop and My docomo data incident: NTT DOCOMO detected unauthorized external access on November 4 and suspended Online Shop and My docomo procedures around 01:05 JST on November 5. It confirmed customer-information leakage before the emergency maintenance.
8. **Resulted In · 100% confidence · current**  
   NTT DOCOMO Online Shop and My docomo data incident: DOCOMO said it had blocked unauthorized access and detected no further leakage. Maintenance continued without an announced restoration time, while the detailed access path and scope remained under investigation.
9. **Occurred At · 100% confidence · current**  
   Online procedures suspended: 2026-11-05
10. **Occurred At · 100% confidence · current**  
   Unauthorized access detected: 2026-11-04
11. **Resulted In · 100% confidence · current**  
   NTT DOCOMO Online Shop and My docomo data incident: Unauthorized access detected
12. **Discovered At · 100% confidence · current**  
   NTT DOCOMO Online Shop and My docomo data incident: 2026-11-04

</details>