NTT Docomo said unauthorized external access leaked customer data on up to 294,839 phone lines, the carrier announced at an emergency briefing on November 6. The figure covers 204,157 individuals and 90,682 corporate accounts, and includes customers who have already canceled their contracts, as of November 6.
President Yoshiaki Maeda apologized at the briefing. "We sincerely apologize for the enormous trouble and worry we have caused," he said.
Docomo has suspended its online shop and My docomo, the portal subscribers use to manage their accounts. It also stopped accepting new applications for ahamo, its online-only plan, as a precaution, and will reopen each service once it has confirmed they are safe. The carrier said it is considering goodwill payments — 見舞金 (mimaikin), a discretionary sum offered to people who have suffered a loss — to both individual and corporate customers, without deciding who would qualify or how much they would receive.
What leaked
The data includes names, dates of birth, addresses, phone numbers, email addresses, identification document numbers, and mobile contract and rate-plan details. For some customers it also includes information on legal representatives and employers, and the names and account numbers of financial institutions used for billing.
Docomo said the numbers on identity documents leaked but that no information directly identifying the type of document did. It declined to say which types of document were involved. My Number identification data was not affected, the carrier said, because it stores neither images nor data of the number. Credit card numbers were masked and did not leak.
The number of customers affected varies by data item, and Docomo has not published a breakdown.
How the breach unfolded
Docomo detected an alert for a large volume of access at around 10:30 a.m. on November 4. It blocked overseas IP addresses, but the block had no effect, and at 4:20 p.m. it suspended My docomo. After cutting off the attack route and confirming the alerts had stopped, it briefly restored the service at 8:32 p.m. that day.
After the restart, at 11:16 p.m. on November 4, it detected a possible unauthorized access. At 1:05 a.m. on November 5 it shut down My docomo and the Docomo online shop, and at 2:10 a.m. it confirmed that customer data had leaked.
The company said at the briefing that the leak stopped at 6:10 p.m. on November 4, when it cut off a specific attack route. The attacker exploited the way several Docomo systems work together to search for and retrieve customer data automatically, it said. Docomo described the attack as using existing functions in combinations the company had not anticipated, and said earlier diagnostics had failed to identify the route.
The decision to restore service temporarily followed existing rules, the company said, adding that it will review how such decisions are made. The challenge is how to keep services running while preventing damage once abnormal access is detected.
Docomo said an outage on November 5 affecting its 5G SA service — a 5G network that runs on dedicated equipment — was a separate matter. It said it found no sign of unauthorized access or a cyberattack in that failure.
Notifications and next steps
Docomo said it has blocked the confirmed attack route and similar ones, and will restore services after modifying its systems and confirming they are secure.
The carrier sent affected individual customers text messages on November 6 with an apology and advice on preventing further harm, and plans more messages and direct mail. Corporate customers are being contacted by sales staff and by text message.
Docomo urged customers not to open links in suspicious emails or text messages, not to open suspicious attachments, and not to enter passwords, PINs or credit card details if asked. It said customers should not trust a contact simply because it knows their name and address, and should call the company's dedicated hotline if anything seems wrong. Customers who notice logins, purchases or contracts they do not recognize should also contact the hotline promptly.
“Protecting the important information customers entrust to us is our basic and extremely important duty.”Yoshiaki Maeda, President, NTT Docomo
Maeda said the company will review its organization and management systems and work to prevent a recurrence.