NTT Docomo Breach: Up to 300,000 Customers' Names, Addresses and Birth Dates Possibly Exposed — Online Shop and My docomo Shut Down, and the Same-Day 5G Outage Was Not the Attack
Docomo detected a likely intrusion on 4 November and took its Online Shop and My docomo offline; up to about 300,000 records with names, addresses, birth dates and phone numbers may be exposed, its third security incident in weeks.
What Happened
NTT Docomo, Japan's largest mobile operator with about 91 million mobile subscriptions, says outsiders very probably got into its servers. Up to about 300,000 customer records may have been exposed. The company detected the intrusion on Wednesday 4 November and, at about 1:05 a.m. on Thursday 5 November, took its Docomo Online Shop and My docomo account portal offline for emergency maintenance.
The records that may have been accessed contain names, postal addresses, dates of birth, mobile phone numbers and contact phone numbers. Docomo has not yet said whether payment details, including credit card data, were involved. That question is still under investigation, as are the cause and the full scope of the intrusion.
Services Still Restricted
The online shop and contract procedures in My docomo stayed suspended through 5 and 6 November, with no reopening date announced. At times customers could still check data usage and bills, but not buy phones or change contracts online. Docomo is directing urgent requests to its shops and retail partners and to its phone support lines.
Docomo says it has found no further leaks since the first discovery. It will contact affected customers individually once it knows who they are, but it has not said how or when.
A Separate Outage, Not the Attack
Hours after the shutdown, at about 11:18 a.m. on 5 November, Docomo customers on 5G standalone (5G SA) began having trouble with calls, data and SMS nationwide. Many people assumed it was part of the attack. Docomo says it was not: the outage was caused by congestion in the switching equipment that handles 5G SA subscribers, and its investigation found no sign of unauthorized access or a cyberattack before or after the outage.
Service came back at about 1:20 a.m. on 6 November, roughly 14 hours later. 4G users, people on non-standalone 5G, operators that rent Docomo's network, and emergency calls were not affected. Customers who switched their phones to 4G as a workaround have been told to switch back. Docomo's terms only pay compensation when service is completely unusable for 24 hours or more, so this outage falls short of that rule.
The Third Incident in Weeks
The breach caps a bad autumn for Docomo and its parent, NTT:
- 19 October: attackers got into a member database run by one of Docomo's contractors. On 27 October Docomo said 443,495 records from its Docomo Hikari "plala (S Course)" internet service had leaked, including names, phone numbers, dates of birth, contact emails and connection IDs. The company said no passwords, card or bank details were taken.
- Mid-October: Docomo briefly took its corporate website, My docomo and the online shop offline for precautionary security maintenance, saying on 22 October that it had found no unauthorized access at the time.
- 4 November: at its earnings briefing, NTT's president apologised for a string of leaks. The group counted 12 data leaks at its companies and contractors in September and October, and October's detected cyberattacks were seven times the level of a year earlier.
It is not yet known whether the new intrusion is connected to the October contractor breach.
Why It Matters
Names, addresses, dates of birth and phone numbers are exactly what scammers need to make convincing fake messages. Expect a wave of SMS, emails and phone calls pretending to be Docomo, offering "compensation" or a "refund", or asking for "identity verification". These usually lead to card-harvesting pages or ask for one-time codes. Phone numbers tied to a real name and address also make SIM-swap attempts and account-recovery fraud more likely.
What Docomo Customers Should Do
- Don't click links in messages about the breach, refunds or compensation. Go to My docomo yourself from a bookmark or the official app once it is back.
- Never share card numbers, passwords or one-time codes by text, email or phone. Docomo says it will not ask for them this way.
- Turn on two-step verification for your d ACCOUNT, and use a unique password for it.
- Ask Docomo about extra checks for SIM changes and number transfers, and treat any sudden "no service" on your phone as urgent. It can be the first sign of a SIM swap.
- Check card and bank statements in the coming weeks, especially if you have saved payment details with Docomo, until the company confirms whether payment data was involved.
Reef Sentinel Take
Two things stand out. First, this is the third security event at Docomo in about three weeks, coming after a contractor breach of almost 450,000 records. That points to wider problems across the group and its suppliers, not one unlucky intrusion. Second, the timing of the outage shows how quickly confusion spreads: a network failure that had nothing to do with the attack was widely read as part of it. Until Docomo publishes the cause and confirms whether payment data was reached, treat this as an exposure of identity data and prepare for phishing that targets customers.
