Docomo Leaked ID Numbers for Up to 294,839 Lines: What To Do

Last checked: Nov 7, 2026. Based on NTT Docomo official notices and Japanese tech news sources.

On November 4, 2026, NTT Docomo detected unauthorized access to the Docomo Online Shop and My docomo systems. According to press conference reporting by CNET Japan, Cybersecurity-jp, and Impress Watch on November 6, 2026, customer information for up to 294,839 phone lines was accessed, including ID document numbers for all affected customers. Docomo's official third notice on November 6 stated the number as "up to approximately 300,000."

Both systems have been under emergency maintenance since around 1:05 AM Japan time on November 5 (7:05 PM Istanbul time November 4), with no restart date announced.

Here's what was leaked, who was affected, and what you should do if you have or had a Docomo phone line.

#What data was exposed

According to NTT Docomo's November 6, 2026 notice, the breach exposed different levels of information depending on the customer:

#Information exposed for all affected customers

#Additional information exposed for some customers

According to Docomo, some affected customers also had the following data exposed:

• Legal representatives' or procedural representatives' names and contact information
• Employer or company name and address
• Bank name, branch, account number, and account holder name (for customers paying by account transfer)
• Child-rearing support program information

#What was not leaked

NTT Docomo confirmed that:

• Credit card numbers were masked and not leaked
• My Number (Japan's national ID number) was not stored in the system

According to CNET Japan, Docomo confirmed that card numbers and My Number information were not included in the breach.

#Who was affected

According to November 6 press conference reporting by CNET Japan, the breach affected up to 294,839 phone lines:

• 204,157 individual contracts
• 90,682 business contracts

Docomo's official third notice on November 6 stated "up to approximately 300,000." The more precise figure comes from press conference reporting.

#Important distinctions

Phone lines vs. people: The 294,839 figure represents phone lines (contract accounts), not necessarily the number of unique people. One person can have multiple phone lines, so the actual number of affected individuals may be lower.

Cancelled customers included: According to CNET Japan and Cybersecurity-jp, customers who already cancelled their Docomo service are included in the breach.

#How the breach happened

According to November 6 press conference reporting by Cybersecurity-jp and Impress Watch:

1. The attacker used d account as the entry point
2. They abused the way multiple linked systems work to search and collect data automatically
3. Two-factor authentication and passkeys worked normally but did not prevent the breach because the attack exploited how systems communicated with each other
4. According to Cybersecurity-jp, the leaked data was reportedly not encrypted

Docomo's official third notice stated the cause as external unauthorized access. Docomo did not disclose which specific ID document type was exposed or who the attacker is.

#Timeline of the breach

As of November 6, both the Docomo Online Shop and My docomo remain under emergency maintenance with no announced restart date.

#Docomo's response

According to CNET Japan and Docomo's official notices, the company is:

• Sending SMS notifications to affected individuals starting November 6
• Considering a goodwill payment to affected customers (details and amount not yet announced)
• Operating a hotline at 0120-451-360 (9:00-20:00 Japan time, or 3:00 AM-2:00 PM Istanbul time)

Cybersecurity-jp reported that, within the sources it checked, it found no announcement confirming misuse.

#What to do if you're affected

If you have or had a Docomo phone line, follow these steps:

#1. Watch for phishing attempts

Scammers could exploit this information to send fake messages claiming to be from Docomo. The leaked ID document numbers could make their messages sound more legitimate.

Never click links or open attachments in messages that mention the breach, even if they look real.

Never enter passwords, PINs, or credit card details in response to any email, text, or call, even if the sender mentions your ID document number or other personal details.

#2. Check official sources directly

Don't trust links in messages. Go to docomo.ne.jp yourself by typing the address into your browser or using a bookmark.

Check Docomo's official notices for updates on the breach and what the company is doing.

#3. Monitor your bank account

If you pay your Docomo bill by bank account transfer, watch your account for any unusual activity. Your bank name, branch, account number, and account holder name may have been exposed.

Report any unfamiliar charges to your bank immediately.

#4. Wait for official communication from Docomo

Docomo is sending SMS notifications to affected customers. If you receive an SMS from Docomo about the breach:

• Do not click any links in the SMS
• Go to docomo.ne.jp directly
• Call the official hotline at 0120-451-360 (09:00–20:00 Japan / 03:00–14:00 Istanbul) if you need to confirm

#5. Be alert for targeted scams

With your name, birth date, address, phone number, and ID document number exposed, scammers can create very convincing targeted messages.

Common post-breach scams include:

• Fake "identity protection" or "credit monitoring" offers
• Messages claiming to help you check if you were affected
• Calls from fake Docomo representatives asking you to "verify" information
• Texts with urgent warnings about your account

When in doubt, hang up and call Docomo's official hotline directly.

#Why ID document numbers matter

Your ID document number combined with your name, birth date, and address creates a detailed identity profile. Docomo did not disclose which type of ID document was involved.

This information could increase the risk of:

• Identity fraud and impersonation
• Social engineering attacks that sound more convincing
• Targeted scams using your verified personal details

Cybersecurity-jp reported that, within the sources it checked, it found no announcement confirming misuse. Stay vigilant in the coming months.

#How data breaches fuel data brokers

When your personal information leaks in a breach like this, it can end up circulating for years. Data brokers collect information from breaches, public records, and other sources, then build detailed profiles that anyone can buy.

Your name, address, phone number, and birth date from this breach could appear on people-search sites long after the immediate crisis passes. These sites make it easy for scammers, stalkers, and identity thieves to find you.

If your email was in a data breach, you know the pattern: one leak leads to more spam, more phishing, and more risk over time.

UndoLeak erases your data from data brokers and keeps it off.

See where you're listed with a free scan.

#Sources

All facts in this article come from the following sources:

• NTT Docomo, "【お詫び】ドコモオンラインショップ、My docomoの緊急メンテナンス実施について/当社サーバーへの不正アクセスによるお客さま情報流出に関するお知らせ（第三報：11月6日 午後6時00分時点）" (Nov 6, 2026)
• CNET Japan, "ドコモ、不正アクセス被害者へお見舞金　流出は29万回線、本人確認書類の番号も（更新）" (Nov 6, 2026)
• Cybersecurity-jp, "NTTドコモがオンラインショップ等への不正アクセスで最大29万4,839件の情報流出を公表" (Nov 6, 2026)
• Impress Watch, "ドコモ不正アクセス、「料金プラン」などの情報も流出 「重く受け止めている」" (Nov 6, 2026)

---

Not affiliated with NTT Docomo or any company mentioned.