NTT Docomo is dealing with two incidents that happened close together but should not be mistaken for one. The carrier confirmed unauthorized access and a customer-data leak involving its online shop and My docomo. Separately, its 5G Standalone network suffered a nationwide service disruption that was restored early on November 6. The company has identified congestion in switching equipment behind the network trouble; it has not established a connection to the data breach.

An intrusion into customer-facing online services

NTT Docomo says it detected unauthorized external access on November 4 to systems serving the Docomo Online Shop and My docomo, the service customers use to manage account-related procedures. In response, the company stopped transactions through the two services at about 1:05 a.m. Japan Standard Time on November 5 and began emergency maintenance. Its initial notice described suspected unauthorized access; an updated notice at 6:30 p.m. that day confirmed that some customer information had already been exposed before access was blocked.

The distinction between suspected entry and confirmed exposure matters. The company has acknowledged both the intrusion and that some information left its control, but the public notice does not name an attacker, identify the technique used, or establish the intrusion path. Coverage from Japanese technology reporters followed the evolution from the early precautionary shutdown to the evening confirmation. Neither the shutdown nor the company’s acknowledgment, by itself, reveals how many unique people had each item of information exposed.

Sources: Unauthorized access to Docomo Online Shop and My docomo and customer information leak (second notice, 6:30 p.m. November 5) · NTT Docomo faces network glitches · NTT Docomo says unauthorized access exposed data of up to about 300,000 customers

What “up to about 300,000” means

The company’s November 5 disclosure puts the maximum number of affected customer-information records at approximately 300,000. It lists names, addresses, dates of birth, mobile telephone numbers and other contact numbers among the information involved. This is an upper-bound estimate in an ongoing investigation, not a final verified count of individual customers, and it should not be read as a statement that every listed data field was exposed for every customer.

The final scope remains unresolved. Docomo said it was continuing to determine the exact data categories, affected records and route of unauthorized access. It would be equally misleading to claim that passwords or payment-card details were taken, or to declare them definitively unaffected, without an explicit finding. A Japanese television report also noted continuing investigation into whether other sensitive categories were involved. The defensible description on November 6 is narrower: specified personal and contact details were involved, with the precise extent still under review.

Sources: Unauthorized access to Docomo Online Shop and My docomo and customer information leak (second notice, 6:30 p.m. November 5) · NTT Docomo says unauthorized access exposed data of up to about 300,000 customers · Docomo unauthorized access: up to approximately 300,000 records leaked

The response and the notification gap

Docomo said it had blocked the unauthorized access and, as of its November 5 evening statement, had not identified additional leakage after emergency maintenance began. That statement was not a declaration that normal online procedures had resumed. The company gave no restoration time for its online shop or My docomo in that disclosure and said it was investigating the breach’s origin and scale. The online-service shutdown therefore has a different operational timeline from the mobile-network incident described below.

The operator also said it would promptly inform affected customers once it established more precise details. That is a commitment to notify, not evidence that individual notifications have already been completed. It warned that attackers or fraudsters might impersonate Docomo through emails, text messages or calls, and urged users not to follow suspicious links, open unexpected attachments or provide passwords, personal details or payment-card information in response to such messages. Those precautions matter even before a definitive affected-customer list is available.

Sources: Unauthorized access to Docomo Online Shop and My docomo and customer information leak (second notice, 6:30 p.m. November 5) · NTT Docomo says unauthorized access exposed data of up to about 300,000 customers · Docomo announces possible exposure of up to about 300,000 customer-information records

A separate disruption to 5G Standalone service

A different incident began at approximately 11:18 a.m. on November 5. Docomo reported difficulties with voice calls, mobile data and SMS for customers subscribed to its 5G Standalone, or 5G SA, service across Japan. The company’s notices specifically excluded ordinary 4G customers, 5G customers without the SA service and mobile virtual network operators using Docomo’s network. It also said emergency calls were unaffected. A nationwide impact area therefore did not mean that all Docomo subscribers lost service.

The network disruption ended at around 1:20 a.m. Japan Standard Time on Friday, November 6, roughly 14 hours and two minutes after it began. Docomo said the necessary corrective measures were complete. It recommended restarting a handset or toggling airplane mode if difficulties persisted and told subscribers who had temporarily selected 4G as a workaround to restore their previous network setting. This restoration announcement applied to 5G SA connectivity; it did not announce that the separate online-shop and account-service maintenance was complete.

Sources: 5G SA voice, data and SMS difficulties resolved (November 6, 1:20 a.m.) · NTT Docomo faces network glitches · Docomo communication disruption restored after roughly 14 hours; exchange congestion identified

The network diagnosis does not explain the data breach

Docomo’s November 6 restoration notice identified congestion in switching equipment handling 5G SA subscribers as the cause of the communication disruption. The same notice stated that its investigation had found no signs of unauthorized access or a cyberattack in connection with the network problem, including around the time it began. Japanese technology outlet ITmedia reported the same official diagnosis in its coverage of the restoration. These findings support treating the service outage as an operational network incident, not as a demonstrated effect of the separate intrusion.

Congestion describes the immediate network condition identified by the carrier. The published notice does not offer a full technical reconstruction of what triggered that congestion, nor does it establish a shared root cause for the two events. By contrast, the unauthorized access affecting the online services is separately confirmed and its entry mechanism remains under investigation. Similar timing can justify asking whether incidents are linked; it cannot substitute for forensic evidence. The responsible conclusion is that no causal link has been established on the evidence available for this report.

Sources: Unauthorized access to Docomo Online Shop and My docomo and customer information leak (second notice, 6:30 p.m. November 5) · 5G SA voice, data and SMS difficulties resolved (November 6, 1:20 a.m.) · Docomo communication disruption restored after roughly 14 hours; exchange congestion identified · 5G SA service difficulties: fifth network notice, no indications of cyberattack (4:00 p.m.)

What customers should watch next

The two investigations are at different stages. For the 5G SA disruption, Docomo has announced restoration and provided a cause at the level of congested switching equipment, although fuller technical detail has not been published. For the data exposure, the company has not yet published a final affected-person count, the specific combination of details exposed for each customer, the method of entry or a completion report for individual notifications. Those missing pieces will determine how precisely the risk to affected customers can be assessed.

Customers who receive unexpected messages purporting to come from the operator should verify them through an independently opened official channel, rather than trusting a link or phone number in the message itself. This is a practical response to Docomo’s own phishing warning, not a claim that every customer was affected or that the network disruption exposed information. The more useful next update will be a dated company statement that resolves the outstanding breach questions, rather than a speculative attempt to weave two separate incidents into a single attack narrative.

Sources: Unauthorized access to Docomo Online Shop and My docomo and customer information leak (second notice, 6:30 p.m. November 5) · 5G SA voice, data and SMS difficulties resolved (November 6, 1:20 a.m.) · Docomo unauthorized access: up to approximately 300,000 records leaked · Docomo announces possible exposure of up to about 300,000 customer-information records