NTT Docomo, Japan's largest mobile carrier, has confirmed that an outside attacker got into Docomo Online Shop and the My docomo customer portal and took customer data. Docomo's own notice, its third report dated 6 November, puts the figure at "up to about 300,000" records. At a press conference that evening, executives gave a more exact count of up to 294,839 phone lines: 204,157 individual contracts and 90,682 corporate ones, as reported by ITmedia Mobile, ASCII.jp, Business Insider Japan and Osegi. Former subscribers are included. The data covers names, dates of birth, addresses, email addresses, identity document numbers and contract details for every affected customer. For some customers it also includes bank account details. President Yoshiaki Maeda apologised in public and said the company had not contained the attack early.
What Happened
The timeline below comes from Docomo's 6 November press conference, as reported by ITmedia Mobile, Business Insider Japan and Osegi:
- 4 November, about 10:30 JST: Docomo's systems raised an alert for a very large volume of access. The traffic came from overseas IP addresses.
- 14:30: Docomo blocked access from overseas IP addresses. This did not stop the activity.
- 16:20: My docomo was put into maintenance mode.
- 18:10: Docomo identified and blocked a specific attack route, along with similar routes. Business Insider Japan reports the company said the data leak itself stopped at this point.
- 20:32: The alerts had stopped, so My docomo was brought back online.
- 23:16: Systems detected possible unauthorised access again.
- 5 November, about 01:05: Docomo suspended procedures on both My docomo and Docomo Online Shop. The company's notice gives this as the official start of the suspension.
- 02:10: Docomo confirmed that customer data had leaked.
As a precaution, Docomo also took down the new-contract site for its ahamo online plan. ITmedia Mobile reports that no unauthorised access to that site has been found. According to the company's notice, the emergency maintenance is still going on, no further leakage has been found, and there is no date for bringing the services back. They will return only after system fixes have been made and checked for safety.
Docomo had a separate 5G SA network outage on 5 November, affecting up to 1.587 million lines according to ITmedia Mobile. The company told Business Insider Japan that the outage had nothing to do with the breach. It blames a memory fault in core network equipment during maintenance work and says it found no sign of a cyberattack.
What Was Taken
Two figures are in circulation for the size of the leak. Docomo's written notice and Jiji Press (via Nippon.com) say up to about 300,000. The figure given at the press conference, reported by several Japanese and English-language outlets, is up to 294,839 lines. Reports differ on how much of the total is corporate: ITmedia Mobile gave only the individual figure of 204,157, while ASCII.jp, Osegi and Business Insider Japan put corporate lines at 90,682. Business Insider Japan notes that the count is as of 6 November.
According to Docomo's third report, these fields leaked for all affected customers:
- Name, date of birth, age
- Address, contact phone number, email address
- Identity document number
- Contract information such as mobile number and contract start date
- Contract terms such as rate plan, options and discounts
These fields leaked for some customers:
- Names and contact details of legal guardians or people acting on the customer's behalf
- Employer or company name and address
- Bank name, branch, account number and account holder name (for customers who pay by direct debit)
- Information about Docomo's child-raising support programme
The list grew between reports. Osegi notes that the 5 November report mentioned only names, addresses, dates of birth and phone numbers. Identity document numbers and plan details were added on 6 November.
Docomo told Business Insider Japan that the leaked data does not directly show what kind of identity document each number belongs to, and it would not say which kinds are included. It said it does not store My Number (Japan's national ID number) as images or data, so My Number was not exposed. It also said credit card numbers are stored masked and did not leak, which Jiji Press also reports. Docomo has not said how many customers each of the "some customers" fields affects.
Why It Matters
This combination of data is very useful to scammers. Real names, dates of birth, addresses, phone numbers, contract details and in some cases bank details let them write messages pretending to be Docomo or a bank that look very convincing. Docomo's own guidance warns that the sender "may seem to know your information." Identity document numbers last far longer than passwords and can't easily be changed, so exposed customers will be at risk of impersonation for a long time.
The way the attack worked matters too. Docomo says its regular vulnerability checks never found this route, because no single system had a flaw. Testing each system separately is common practice, and it misses risks that only show up when systems are used together. The decision to bring My docomo back online at 20:32, after which a second wave of suspicious access appeared, is also worth studying. Docomo says that decision followed its existing rules, and it now plans to review how such calls are made.
There is no public report of the leaked data being misused so far. No group has claimed the attack, and Docomo has not named an attacker.
The Attack Technique
According to Docomo, as reported by ITmedia Mobile, Osegi and Business Insider Japan, the attacker came in over the internet and abused the way several of Docomo's linked systems work together to search for and pull customer records automatically. The company describes it as existing features used in a combination nobody had planned for, not a flaw in any one system. Business Insider Japan reports that the route had not shown up in earlier security assessments.
Osegi reports that Vice President Juichi Tsuboya said this was not a "so-called API attack," and that Docomo is still checking whether AI agents were used. The company has not explained which systems were involved, how the attacker got access to the first one, or whether any customer login details were used. The traffic came from overseas IP addresses, but blocking overseas traffic did not stop it. That suggests the attacker could switch sources or that other routes were open. Docomo's notice says the investigation into the cause, the entry route and the full scope of the leak is still going on.
What Organizations Should Do
- Test how your systems behave together, not just one at a time. Map how customer-facing portals, shop front-ends and back-office systems call one another. Then test for ways to chain normal functions together to search for or bulk-export records. Separate vulnerability scans of each system will not catch this.
- Limit and alert on bulk record lookups at the data layer. Set limits on how many records can be retrieved per session, account and source, and alert when one user or route reads far more records than normal. Blocking by IP address or country failed here and should not be the main defence.
- Make it hard to bring a service back after an attack. Before restarting a system that was attacked, require proof that the attacker no longer has any way in, not just that the alerts have stopped. Write down who has the authority to keep a service down.
- Store less sensitive data in places customer portals can reach. Docomo's masking of card numbers and its choice not to store My Number data limited the damage. Apply the same approach to bank details and identity document numbers: mask, tokenise or move them out of systems that a customer-facing portal can query.
- Get ready for phishing that uses the leaked data. Organisations with customers in common with Docomo, especially Japanese banks and other carriers, should expect convincing impersonation attempts using real personal details. Tighten checks on account changes and bank detail changes, and warn customers early.
- Tell customers clearly and keep the details consistent. Docomo sent SMS alerts to affected individuals on 6 November, plans direct mail, and is reaching corporate customers through account managers. Its published helpline hours don't match, though: the notice says 9:00 to 20:00, while ITmedia Mobile reported 9:00 to 18:00 (until 22:00 on 6 November only). Accounts of compensation also differ: Jiji Press says the company plans to pay, while other outlets say it is still considering payment and has not set who qualifies or how much. A single, authoritative message avoids this kind of confusion.
Sources: NTT Docomo breach leaks up to 300,000 customer records | NTT Docomo Reports Data Breach Affecting Approximately 300,000 User... | NTTドコモが「不正アクセス事案」「5G SAの通信障害」について説明 不正アクセスでは「見舞金」の支払いも検討 - ITmedia... | NTT Docomo breach: My docomo data of 294,839 lines · Osegi | NTTドコモで約30万回線の情報漏洩。My docomoなど停止で何が起きたのか。見舞金の支払いも検討 Business Insid... | Docomo says data on up to 294,839 phone lines was taken through My... | ドコモからのお知らせ : 【お詫び】ドコモオンラインショップ、My docomoの緊急メンテナンス実施について/当社サーバーへの不正ア... | NTT Docomo Chief Says Personal Info Breached in Cyberattack Nippon...