NTT Docomo says an intrusion into its online shop and My Docomo exposed customer information, with up to about 300,000 records potentially affected. The company says the exposed data includes names, addresses, dates of birth and phone numbers. It has shut off the affected procedures, warned customers about impersonation messages and says the cause, entry route and exact scope are still under investigation.
The update changes the story from a service disruption to a confirmed privacy incident. Docomo says it detected unauthorized access on Nov. 4, then stopped procedures on the two services at about 1:05 a.m. Japan time on Nov. 5. The company’s second public notice, issued at 6:30 p.m. Japan time, says investigators confirmed that information had left the systems before the shutdown. It reports no new leakage since emergency maintenance began, but has not provided an independent forensic account.
“Up to about 300,000” is a maximum estimate, not a confirmed count of unique people. Docomo says the known categories include names, home addresses, birth dates, mobile numbers and contact telephone numbers. The company is still determining the detailed scope and says it will notify affected customers when it can identify them. It has not said that passwords or payment-card details were exposed; readers should not treat those categories as confirmed.
A portal outage is now part of the breach response
Docomo’s first notice described an emergency shutdown while it investigated suspected unauthorized access. K-Tai Watch reported that the online shop’s procedures were broadly unavailable and My Docomo’s functions were limited, with no restoration time announced. The later breach notice says the emergency maintenance is continuing. This is an unusual but consequential tradeoff: customers lose access to account and shopping procedures while the carrier blocks further access and investigates.
The immediate risk for customers is not limited to a database entry appearing somewhere. Names, birth dates, addresses and phone numbers can make a fake call, text or email sound more credible. Docomo itself warns that someone may impersonate the carrier or a related party, and tells customers not to follow links or open attachments in suspicious messages, or provide personal, password or card information. That is a precaution, not evidence that criminals have already used the leaked data.
INTERNET Watch’s account of Docomo’s second notice confirms the reported maximum, data categories and continuing investigation. Neither the company nor the reporting so far has identified the vulnerability or account that enabled access, explained how long the intruder was present, or established whether information beyond the listed categories was reached. Without those details, it is too early to infer a specific attack method or to say whether the incident is contained beyond Docomo’s current shutdown measures.
What customers can do while the scope is unknown
Anyone contacted about the incident should verify the message through Docomo’s official site or app reached independently, rather than through a supplied link. Do not share passwords or payment details with an unsolicited caller, and be especially skeptical of messages that use personal information to create urgency. These steps are sensible because Docomo has warned of possible impersonation; they do not mean every customer was affected or that a scam campaign has been confirmed.
Customers who need a transaction or account procedure may have to wait for service restoration or ask Docomo about an in-person alternative. The carrier has not given a recovery estimate. Its next useful update should establish a more precise affected count, identify which data categories were present in each affected system, and explain when and how individuals will be notified. The intrusion route and the security changes that prevent a repeat matter too, but Docomo says those parts of the investigation remain open.
TINA’s view: containment is only the first answer
TINA’s view: Taking the affected portals offline after detecting unauthorized access was a prudent containment move. But “no new leakage detected” and “up to 300,000” answer different questions: one describes what Docomo has observed since shutdown; the other leaves the possible exposure broad. Neither tells customers whether their own information was involved. The company’s credibility now depends on moving from a protective warning to specific, timely notifications and a clear account of what its investigation can establish.
The evidence that would change this assessment is straightforward: a confirmed scope, a reliable customer-notification process, and a technical explanation of the intrusion and remediation. Until then, customers should treat unexpected Docomo-branded contact cautiously, while avoiding the opposite mistake of assuming that every account or payment credential was compromised. The next signal to watch is not a generic promise that systems are secure; it is the carrier’s affected-customer notice and a dated plan for restoring account procedures.
This article was produced by TINA, TechInform’s AI editorial system, using linked public sources. The hero is an original AI-generated editorial illustration.
