# NTT Docomo Confirms Customer Data Leak as Separate 5G SA Outage Ends

> MKNIRALO — Technology — JAPAN | TELECOM & DATA SECURITY

- Published: 2026-11-06
- Estimated reading time: 7 minutes
- Byline: Niko — Cybersecurity, Semiconductors & Digital Infrastructure Observer
- Byline disclosure: Niko is a house editorial byline maintained by MKNIRALO, not a claim of an independently verified individual. It does not imply cybersecurity certification, security-clearance status, employment by a technology vendor or government, hands-on incident-response work, penetration testing or access to nonpublic systems. Articles distinguish official claims, technical disclosures, independently corroborated findings and unresolved attribution.
- Author profile: https://mkniralo.com/authors/niko/
- Tags: Japan, NTT Docomo, Cybersecurity, Data Breach, Telecommunications, 5G Standalone
- Cover image: https://mkniralo.com/images/ntt-docomo-customer-data-leak-separate-5g-sa-outage-2026.svg

NTT Docomo says customer information was exposed in unauthorized access affecting its online services. A separate 5G Standalone outage has ended, with network congestion cited as its cause.

NTT Docomo is dealing with two incidents that happened close together but should not be mistaken for one. The carrier confirmed unauthorized access and a customer-data leak involving its online shop and My docomo. Separately, its 5G Standalone network suffered a nationwide service disruption that was restored early on November 6. The company has identified congestion in switching equipment behind the network trouble; it has not established a connection to the data breach.

## An intrusion into customer-facing online services

NTT Docomo says it detected unauthorized external access on November 4 to systems serving the Docomo Online Shop and My docomo, the service customers use to manage account-related procedures. In response, the company stopped transactions through the two services at about 1:05 a.m. Japan Standard Time on November 5 and began emergency maintenance. Its initial notice described suspected unauthorized access; an updated notice at 6:30 p.m. that day confirmed that some customer information had already been exposed before access was blocked.

The distinction between suspected entry and confirmed exposure matters. The company has acknowledged both the intrusion and that some information left its control, but the public notice does not name an attacker, identify the technique used, or establish the intrusion path. Coverage from Japanese technology reporters followed the evolution from the early precautionary shutdown to the evening confirmation. Neither the shutdown nor the company’s acknowledgment, by itself, reveals how many unique people had each item of information exposed.

Sources:
- [Unauthorized access to Docomo Online Shop and My docomo and customer information leak (second notice, 6:30 p.m. November 5)](https://www.docomo.ne.jp/info/notice/page/261105_03_m.html) — NTT Docomo
- [NTT Docomo faces network glitches](https://www.japantimes.co.jp/business/2026/11/05/ntt-docomo-network-glitches/) — The Japan Times / Jiji
- [NTT Docomo says unauthorized access exposed data of up to about 300,000 customers](https://internet.watch.impress.co.jp/docs/news/2154115.html) — INTERNET Watch

## What “up to about 300,000” means

The company’s November 5 disclosure puts the maximum number of affected customer-information records at approximately 300,000. It lists names, addresses, dates of birth, mobile telephone numbers and other contact numbers among the information involved. This is an upper-bound estimate in an ongoing investigation, not a final verified count of individual customers, and it should not be read as a statement that every listed data field was exposed for every customer.

The final scope remains unresolved. Docomo said it was continuing to determine the exact data categories, affected records and route of unauthorized access. It would be equally misleading to claim that passwords or payment-card details were taken, or to declare them definitively unaffected, without an explicit finding. A Japanese television report also noted continuing investigation into whether other sensitive categories were involved. The defensible description on November 6 is narrower: specified personal and contact details were involved, with the precise extent still under review.

Sources:
- [Unauthorized access to Docomo Online Shop and My docomo and customer information leak (second notice, 6:30 p.m. November 5)](https://www.docomo.ne.jp/info/notice/page/261105_03_m.html) — NTT Docomo
- [NTT Docomo says unauthorized access exposed data of up to about 300,000 customers](https://internet.watch.impress.co.jp/docs/news/2154115.html) — INTERNET Watch
- [Docomo unauthorized access: up to approximately 300,000 records leaked](https://news.tv-asahi.co.jp/news_economy/articles/000545639.html) — TV Asahi News

## The response and the notification gap

Docomo said it had blocked the unauthorized access and, as of its November 5 evening statement, had not identified additional leakage after emergency maintenance began. That statement was not a declaration that normal online procedures had resumed. The company gave no restoration time for its online shop or My docomo in that disclosure and said it was investigating the breach’s origin and scale. The online-service shutdown therefore has a different operational timeline from the mobile-network incident described below.

The operator also said it would promptly inform affected customers once it established more precise details. That is a commitment to notify, not evidence that individual notifications have already been completed. It warned that attackers or fraudsters might impersonate Docomo through emails, text messages or calls, and urged users not to follow suspicious links, open unexpected attachments or provide passwords, personal details or payment-card information in response to such messages. Those precautions matter even before a definitive affected-customer list is available.

Sources:
- [Unauthorized access to Docomo Online Shop and My docomo and customer information leak (second notice, 6:30 p.m. November 5)](https://www.docomo.ne.jp/info/notice/page/261105_03_m.html) — NTT Docomo
- [NTT Docomo says unauthorized access exposed data of up to about 300,000 customers](https://internet.watch.impress.co.jp/docs/news/2154115.html) — INTERNET Watch
- [Docomo announces possible exposure of up to about 300,000 customer-information records](https://newsdig.tbs.co.jp/articles/withbloomberg/3065522?display=1) — TBS NEWS DIG

## A separate disruption to 5G Standalone service

A different incident began at approximately 11:18 a.m. on November 5. Docomo reported difficulties with voice calls, mobile data and SMS for customers subscribed to its 5G Standalone, or 5G SA, service across Japan. The company’s notices specifically excluded ordinary 4G customers, 5G customers without the SA service and mobile virtual network operators using Docomo’s network. It also said emergency calls were unaffected. A nationwide impact area therefore did not mean that all Docomo subscribers lost service.

The network disruption ended at around 1:20 a.m. Japan Standard Time on Friday, November 6, roughly 14 hours and two minutes after it began. Docomo said the necessary corrective measures were complete. It recommended restarting a handset or toggling airplane mode if difficulties persisted and told subscribers who had temporarily selected 4G as a workaround to restore their previous network setting. This restoration announcement applied to 5G SA connectivity; it did not announce that the separate online-shop and account-service maintenance was complete.

Sources:
- [5G SA voice, data and SMS difficulties resolved (November 6, 1:20 a.m.)](https://www.docomo.ne.jp/info/network/kanto/pages/261106_00_m.html) — NTT Docomo
- [NTT Docomo faces network glitches](https://www.japantimes.co.jp/business/2026/11/05/ntt-docomo-network-glitches/) — The Japan Times / Jiji
- [Docomo communication disruption restored after roughly 14 hours; exchange congestion identified](https://www.itmedia.co.jp/news/article/2611/06/2000002932/) — ITmedia NEWS

## The network diagnosis does not explain the data breach

Docomo’s November 6 restoration notice identified congestion in switching equipment handling 5G SA subscribers as the cause of the communication disruption. The same notice stated that its investigation had found no signs of unauthorized access or a cyberattack in connection with the network problem, including around the time it began. Japanese technology outlet ITmedia reported the same official diagnosis in its coverage of the restoration. These findings support treating the service outage as an operational network incident, not as a demonstrated effect of the separate intrusion.

Congestion describes the immediate network condition identified by the carrier. The published notice does not offer a full technical reconstruction of what triggered that congestion, nor does it establish a shared root cause for the two events. By contrast, the unauthorized access affecting the online services is separately confirmed and its entry mechanism remains under investigation. Similar timing can justify asking whether incidents are linked; it cannot substitute for forensic evidence. The responsible conclusion is that no causal link has been established on the evidence available for this report.

Sources:
- [Unauthorized access to Docomo Online Shop and My docomo and customer information leak (second notice, 6:30 p.m. November 5)](https://www.docomo.ne.jp/info/notice/page/261105_03_m.html) — NTT Docomo
- [5G SA voice, data and SMS difficulties resolved (November 6, 1:20 a.m.)](https://www.docomo.ne.jp/info/network/kanto/pages/261106_00_m.html) — NTT Docomo
- [Docomo communication disruption restored after roughly 14 hours; exchange congestion identified](https://www.itmedia.co.jp/news/article/2611/06/2000002932/) — ITmedia NEWS
- [5G SA service difficulties: fifth network notice, no indications of cyberattack (4:00 p.m.)](https://www.docomo.ne.jp/info/network/kanto/pages/261105_06_m.html) — NTT Docomo

## What customers should watch next

The two investigations are at different stages. For the 5G SA disruption, Docomo has announced restoration and provided a cause at the level of congested switching equipment, although fuller technical detail has not been published. For the data exposure, the company has not yet published a final affected-person count, the specific combination of details exposed for each customer, the method of entry or a completion report for individual notifications. Those missing pieces will determine how precisely the risk to affected customers can be assessed.

Customers who receive unexpected messages purporting to come from the operator should verify them through an independently opened official channel, rather than trusting a link or phone number in the message itself. This is a practical response to Docomo’s own phishing warning, not a claim that every customer was affected or that the network disruption exposed information. The more useful next update will be a dated company statement that resolves the outstanding breach questions, rather than a speculative attempt to weave two separate incidents into a single attack narrative.

Sources:
- [Unauthorized access to Docomo Online Shop and My docomo and customer information leak (second notice, 6:30 p.m. November 5)](https://www.docomo.ne.jp/info/notice/page/261105_03_m.html) — NTT Docomo
- [5G SA voice, data and SMS difficulties resolved (November 6, 1:20 a.m.)](https://www.docomo.ne.jp/info/network/kanto/pages/261106_00_m.html) — NTT Docomo
- [Docomo unauthorized access: up to approximately 300,000 records leaked](https://news.tv-asahi.co.jp/news_economy/articles/000545639.html) — TV Asahi News
- [Docomo announces possible exposure of up to about 300,000 customer-information records](https://newsdig.tbs.co.jp/articles/withbloomberg/3065522?display=1) — TBS NEWS DIG

## About this article

This article reflects the public sources available on the publication and update dates shown above. For developing stories, follow the linked source pages for subsequent statements or decisions.

## Sources and further reading

- [Unauthorized access to Docomo Online Shop and My docomo and customer information leak (second notice, 6:30 p.m. November 5)](https://www.docomo.ne.jp/info/notice/page/261105_03_m.html) — NTT Docomo (published 2026-11-05) (accessed 2026-11-06)
- [5G SA voice, data and SMS difficulties resolved (November 6, 1:20 a.m.)](https://www.docomo.ne.jp/info/network/kanto/pages/261106_00_m.html) — NTT Docomo (published 2026-11-06) (accessed 2026-11-06)
- [NTT Docomo faces network glitches](https://www.japantimes.co.jp/business/2026/11/05/ntt-docomo-network-glitches/) — The Japan Times / Jiji (published 2026-11-05) (accessed 2026-11-06)
- [NTT Docomo says unauthorized access exposed data of up to about 300,000 customers](https://internet.watch.impress.co.jp/docs/news/2154115.html) — INTERNET Watch (published 2026-11-05) (accessed 2026-11-06)
- [Docomo communication disruption restored after roughly 14 hours; exchange congestion identified](https://www.itmedia.co.jp/news/article/2611/06/2000002932/) — ITmedia NEWS (published 2026-11-06) (accessed 2026-11-06)
- [Docomo unauthorized access: up to approximately 300,000 records leaked](https://news.tv-asahi.co.jp/news_economy/articles/000545639.html) — TV Asahi News (published 2026-11-06) (accessed 2026-11-06)
- [Docomo announces possible exposure of up to about 300,000 customer-information records](https://newsdig.tbs.co.jp/articles/withbloomberg/3065522?display=1) — TBS NEWS DIG (published 2026-11-05) (accessed 2026-11-06)
- [5G SA service difficulties: fifth network notice, no indications of cyberattack (4:00 p.m.)](https://www.docomo.ne.jp/info/network/kanto/pages/261105_06_m.html) — NTT Docomo (published 2026-11-05) (accessed 2026-11-06)