Docomo says data on up to 294,839 phone lines was taken through My docomo, including ID document numbers

NTT Docomo, Japan’s largest mobile carrier, said on November 5, 2026 that someone had broken into its My docomo customer portal and its Docomo Online Shop, and that some customer information had left its systems. On November 6 it put numbers and a full list of data to it: up to 294,839 phone lines, with details such as names, addresses and the numbers of identity documents. If you have a Docomo line, here is what the company has said so far.

What happened

Docomo’s notices and its press briefing on the evening of November 6 give this order of events:

• November 4, about 10:30 AM: Docomo’s systems raised an alert for a very large volume of access. The traffic came from overseas IP addresses, so the company first blocked access from abroad. When that didn’t stop it, it took My docomo offline and blocked specific attack routes, including similar ones. The alerts stopped and My docomo was brought back.
• A few hours later: the systems flagged possible unauthorized access again. Docomo took My docomo down a second time and shut the Docomo Online Shop as well. Its notice says procedures on both stopped from about 1:05 AM on November 5.
• November 5: Docomo published its second report (in Japanese), saying some customer information had been taken, up to about 300,000 records, and that the cause was still being investigated.
• November 6: its third report (in Japanese) listed the data and gave the cause as unauthorized access from outside. At a briefing that evening, President Yoshiaki Maeda and two vice presidents said the count was up to 294,839 lines, of which 204,157 are individual contracts, according to ITmedia Mobile (in Japanese). ASCII.jp, which translated its report from Japanese, puts the rest at 90,682 corporate lines.

ITmedia reports that Docomo described the attacker as taking advantage of the way several of its systems are linked together, searching for and collecting the information automatically. Docomo hasn’t said how the attacker got in, who it was, or how long the activity lasted. Its notice says new leaks haven’t been confirmed since the emergency maintenance began. The ahamo sign-up site hasn’t shown signs of unauthorized access, but Docomo has paused it as a precaution.

What data was involved

For every affected line, Docomo lists five kinds of information:

1. name, date of birth, age and similar details
2. address, contact phone number, email address and similar contact details
3. identity document number
4. contract details such as the mobile phone number and the start date
5. plan, options and discounts

For some customers, it also includes the names and contact details of legal representatives or people who handle procedures on their behalf, a company name and address, financial institution name, branch, account number and account holder, and information about Docomo’s child-rearing support program. The bank details are for customers who pay by account transfer, according to ITmedia.

The lists published so far don’t mention passwords or credit card numbers. Docomo hasn’t said in so many words that they were not involved, so watch for its updates.

What Docomo is doing

• My docomo, the Docomo Online Shop and the ahamo sign-up site are being reworked, and Docomo says they will come back only after the fixes are checked. There is no restart date yet.
• Affected individuals were sent an SMS on November 6, and Docomo is considering more messages and letters. It says it will contact affected business customers through their sales representatives, SMS or mail.
• Docomo is considering a goodwill payment to affected customers. Who would get it, and how much, hasn’t been decided.
• A dedicated phone line is open at 0120-451-360 (in Japan).

Docomo’s notice warns that the stolen details could be used for fake emails, texts and calls pretending to be Docomo or related companies. It asks people not to open links or attachments in them and not to enter personal information, passwords or card details.

What this means for you

Names, addresses and phone numbers go together with contract details and an ID number. That makes a fake call or text from "Docomo" more convincing, because the caller can read back real details. The ID document number is the part you can’t change, so the goal is to keep it from being useful. Another risk to keep in mind is a SIM swap, where someone convinces a carrier to move your number to their SIM to receive your sign-in codes. Docomo hasn’t said this is happening in this case.

What you can do

1. Don’t click links or call numbers in messages claiming to be from Docomo. Even if the sender knows your plan or address, open the My docomo app or type the address yourself. Be careful with SMS about this very incident, since Docomo itself is sending some.
2. Check your accounts. Look at your bank statements and your Docomo bill for anything you don’t recognize, and ask Docomo about any contract, purchase or login you didn’t make.
3. Change your My docomo password, and your passwords anywhere you reused it, once the service is back. Passwords weren’t listed as taken, but it costs little.
4. Protect the number itself. If you use SMS codes for important accounts, move them to an authenticator app or a passkey where you can. Our guide to SIM swaps is written for Canada, but the way the scam works is the same everywhere.
5. Be careful with anyone who knows your details. A caller who can recite your address and plan is not proof they work for your carrier or bank. Hang up and call the number on your card or bill.

How Frame helps

Add this breach to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame’s email aliases also let you give each service its own address, so a fake message that arrives at the wrong one stands out. Frame never collects or stores the leaked records themselves.

Related coverage

• How scammers use leaked data to make phishing personal: why details like a plan name or an address make a fake message feel real.
• SIM swaps: how someone takes your phone number: what to lock down when your number and personal details are in play.
• So-net and plala breach: another Japanese internet provider whose member database was breached last month.

Sources

• NTT Docomo, 第三報（11月6日 午後6時00分時点）：ドコモオンラインショップ、My docomoの緊急メンテナンス実施について／当社サーバーへの不正アクセスによるお客さま情報流出に関するお知らせ (in Japanese), November 6, 2026
• NTT Docomo, 第二報（11月5日 午後6時30分時点） (in Japanese), November 5, 2026
• ITmedia Mobile, NTTドコモが「不正アクセス事案」「5G SAの通信障害」について説明 (in Japanese), November 6, 2026
• ASCII.jp English Edition, NTT Docomo Reports Data Breach Affecting Approximately 300,000 Users Due to Unauthorized Access, Urges Caution (AI-translated from Japanese), November 6, 2026