NTT Docomo discloses unauthorised access exposing personal data of up to 294,839 accounts (2026)

On 5 November 2026, NTT Docomo — Japan's largest mobile carrier, a subsidiary of Nippon Telegraph and Telephone (NTT) serving tens of millions of subscribers — disclosed that unauthorised access to its My docomo online account portal and Docomo Online Shop may have exposed the personal information of up to 294,839 accounts. The company said the affected accounts broke down into roughly 204,157 individual users and 90,682 corporate users, a figure other outlets rounded to "about 300,000."

What happened

Docomo said it first detected abnormal, high-volume access against My docomo and confirmed unauthorised access on 4 November 2026. After an initial attempt to contain the activity, the carrier detected renewed unauthorised access and, from around 01:00 on 5 November, suspended both My docomo and the Docomo Online Shop for emergency maintenance. As of the latest reporting the services remained offline with no firm restoration timeline, and the cause and entry route were still under investigation. Docomo has not said whether account passwords were among the data exposed.

What was exposed

According to the disclosures, the potentially leaked data includes customers' names, dates of birth, addresses, phone numbers and contract details. For some users the exposed information may also extend to account and financial-institution details and certain programme enrolment data; whether payment-card numbers or "My Number" national identification numbers were affected was still being verified. Docomo began notifying affected customers by SMS, said further notices would follow, and signalled it would offer a goodwill payment once details were finalised.

Why it matters

The breach is the latest in a run of cyber incidents striking large Japanese corporations, and it lands on one of the country's most sensitive consumer datasets: the contact and contract records of a national carrier's subscriber base. With names, addresses, birth dates and phone numbers potentially in attackers' hands, the most immediate downstream risk is targeted phishing and impersonation — a point Docomo underscored in warning customers to be alert to fraudulent messages that could exploit the stolen information.