NTT Docomo Breach Exposed Plan Details and Bank Data of Up to 294,839 Lines

How the attack unfolded

According to Docomo, an external attacker used the internet to exploit the way several linked systems interact, and searched for and retrieved user data automatically. The company detected a high-volume access alert at 10:30 on 4 November. Blocking overseas IP addresses at 14:30 had no effect, and My docomo went into maintenance mode at 16:20. After a specific attack route was cut, the service was restored at 20:32, but a further sign of unauthorized access led the company to take both My docomo and the online shop offline at 1:05 on 5 November. The leak was confirmed at 2:10.

Docomo says this was not a flaw in the systems themselves but an abuse of linked systems, a route that its regular vulnerability assessments had not identified. Vice President Juichi Tsuboya said it was not a so-called API attack, and the company is still checking whether AI agents were used. President Yoshiaki Maeda said: "We do not think we contained it early. 300,000 is a large number and the information is important. We take this seriously."

Response and a separate outage

Individual customers were sent an SMS on 6 November with an apology, an overview and safety advice, while corporate customers will be contacted by sales staff, SMS or direct mail. Docomo is considering condolence payments for both groups, with details to follow. Users are urged not to open URLs or attachments in suspicious emails or SMS messages.

The company also explained a 5G SA outage from about 11:18 on 5 November to about 1:20 on 6 November that affected up to roughly 1.587 million subscribers nationwide. A memory fault in part of the switching equipment, triggered by core network maintenance, caused processing delays and congestion. Emergency alerts and MVNOs on Docomo lines were unaffected. A temporary fix is in place, and a permanent measure is due within a week.