SockAnalyst
← All playbooks
HighBreach · 2026-11-06

NTT Docomo: up to ~300k customer records leaked from My docomo / Online Shop

What happened

NTT Docomo confirmed unauthorized external access to its Online Shop and My docomo platforms, detected on November 4, 2026. The company halted online procedures from about 01:05 JST on November 5 for emergency maintenance and, in successive notices culminating in a third report dated November 6, 2026 18:00 JST, confirmed that customer information leaked before access was cut off. Maximum scope is about 300,000 records. For all affected customers Docomo lists names, dates of birth/age, addresses, contact phone numbers and email, identity-document numbers, mobile numbers and contract start dates, plus plan/option/discount details. For some customers it also lists agent/guardian contacts, employer/corporate details, bank name/branch/account number/name, and parenting-program information. Cause is described only as external unauthorized access; restoration timing for the online services is undetermined. Docomo says further leakage has not been confirmed since maintenance began.

Who's affected

NTT Docomo Online Shop and My docomo customers in Japan (up to ~300,000). Broader risk: anyone who reused Docomo-related passwords elsewhere, and SOC teams watching for Docomo-themed phishing/SMS/vishing that abuses the leaked PII.

✅ Fix / patch

  • If you or users may be among the affected: watch for Docomo-impersonating email, SMS and phone calls; do not click URLs in unsolicited messages, open attachments, or give passwords, card numbers or personal data over those channels. Docomo published a dedicated inquiry line (0120-451-360, 09:00–20:00 JST).
  • Force password resets and MFA review for any account where Docomo-related credentials or personal data might have been reused; treat identity-document numbers and bank details as high-risk for fraud and account takeover.
  • For organizations with Japan-facing customers or employees on Docomo: brief helpdesk/SOC on expected scam patterns tied to this disclosure and add detection for Docomo lookalike domains and brand spoofing.

🔎 Quick hunt check

No public IOCs, CVE or intrusion method from Docomo. Hunt for phishing/SMS/vishing that spoofs Docomo, My docomo or the Online Shop (lookalike domains, brand-impersonating senders, and unexpected password-reset or 'maintenance' themes). Correlate newly reported account-takeover or fraud tickets that cite Docomo customer identifiers against this disclosure window.

MITRE ATT&CK: T1078, T1213, T1566, T1598

IOCs

No IOCs (IPs, domains or hashes) published by the sources yet.

Hunt queries

Starting points built only from published indicators. Field names vary; tune before use.

index=email OR index=proxy OR index=dns ("docomo" OR "My docomo" OR "ドコモ" OR subject="*docomo*" OR url="*docomo*")
| eval lookalike=if(match(url,"(?i)docomo") AND NOT match(url,"(?i)(\.|^)docomo\.ne\.jp"),"yes","no")
| where lookalike="yes" OR match(subject,"(?i)(password|reset|maintenance|緊急|不正)")
| stats count min(_time) as first max(_time) as last values(src_user) as senders values(url) as urls by subject, recipient
EmailEvents
| where TimeGenerated >= ago(14d)
| where Subject has_any ("docomo","My docomo","ドコモ","不正アクセス","緊急メンテナンス")
    or SenderFromDomain has "docomo"
| where SenderFromDomain !endswith "docomo.ne.jp" and SenderFromDomain !endswith "nttdocomo.com"
| summarize Emails=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated),
    Subjects=make_set(Subject,10) by SenderFromAddress, SenderFromDomain, RecipientEmailAddress
| order by Emails desc

⏱ CISA deadline

Not in CISA KEV as of Nov 6, 2026.

Sources

Related playbooks