Short answer
NTT Docomo said on 5 November 2026 that it detected unauthorized external access to the Docomo Online Shop and My docomo and that some customer information had leaked, up to about 300,000 customers. The cause and route were still under investigation, and both services were in emergency maintenance.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | NTT Docomo |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Telecommunications |
| Country | Japan |
| Detected | 2026-11-04 |
| Disclosed | 2026-11-05 |
| People or records affected | Up to about 300,000 customers, with scope still under investigation |
What data was exposed
- Names and addresses
- Dates of birth
- Mobile phone numbers and contact phone numbers
What happened
NTT Docomo, Japan’s largest mobile carrier, said it detected unauthorized access from outside to the Docomo Online Shop and My docomo on Wednesday 4 November 2026. From about 1:05 a.m. on 5 November it suspended procedures on both services and started emergency maintenance, according to Docomo’s second report and Impress Watch.
Impress Watch lays out the sequence. At 9:00 a.m. on 5 November the first announcement said outside access was likely. At 6:30 p.m. the second announcement confirmed that some customer information had leaked in access that took place before the maintenance began.
What was taken and how many
Docomo said up to about 300,000 customers were affected. The data named in the notice is names, addresses, dates of birth, mobile phone numbers and contact phone numbers. The company said it was still investigating the details and would tell affected customers promptly once they were confirmed.
Docomo said access is blocked and that it had seen no new leaks since the emergency maintenance started. It did not give a restoration time.
What is not known
The intrusion route and the cause had not been disclosed as of the second report. The sources we read do not say whether passwords, plan details or payment data were reached, so we have not listed them. We found no claim of responsibility.
Why the data matters
A name, address, date of birth and mobile number together are enough to make a fake call or SMS convincing. They are also the kind of details a criminal needs to try to impersonate you to a carrier or bank. Docomo itself warned customers to watch for suspicious emails, SMS or calls that pretend to be from Docomo or related parties, not to open URLs or attachments in unexpected messages, and not to enter personal information, passwords or card details in response.
If you have a Docomo line, read our data breach checklist. Number-takeover tricks are covered in the guide to SIM swap and account takeover scams, and fake-carrier messages follow the pattern in phishing messages. More incidents from the same week are on the breaches index.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake Docomo emails and SMS about account problems, point expiry or a 'security update' with a link to a lookalike login page.
- Phone calls from someone claiming to be Docomo who already knows your name, address and birth date.
- SIM swap attempts, where a criminal uses your personal details to try to move your number to another SIM or phone.
- Requests for card details or SMS codes presented as a way to 'restore' your account.
What to do if you are affected
- 01Do not open links or attachments in unexpected messages about Docomo. Use the official app or site, or dial 151 from a Docomo phone.
- 02Never enter passwords, card details or one-time codes after a message or call you did not start.
- 03Watch for unexpected SMS codes or sudden loss of mobile signal, which can signal a SIM swap, and tell Docomo straight away.
- 04Check your Docomo account and bank or card statements for activity you did not make.
Frequently asked questions
How many Docomo customers were affected?
Docomo said up to about 300,000 customers. Impress Watch notes that the exact scope and count were still being investigated as of 5 November.
What information was leaked?
According to Docomo's second report, names, addresses, dates of birth, mobile phone numbers and contact phone numbers. The company said it was still checking the details.
Is it safe to use My docomo now?
As of the second report, both My docomo and the Docomo Online Shop were in emergency maintenance with no restoration time set. Docomo said it saw no new leaks after maintenance began.
Who should I contact?
Docomo lists its Information Center: dial 151 from a Docomo phone, or 0120-800-000 from other phones, open 9:00 to 20:00 every day.
Sources
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.