On Thursday, November 5, NTT Docomo — Japan's largest mobile carrier — told customers that up to around 300,000 sets of customer information had been compromised through unauthorized access to its servers. The breached information includes customers' names, addresses, dates of birth, and phone numbers. The company said it is still investigating whether payment information, including credit card details, was also compromised.
The timeline is short and sharp. Docomo detected unauthorized access on Wednesday, November 4, and suspended its online shop and the "My docomo" customer portal — the service subscribers use to check usage, pay bills, and change contracts — in the early hours of Thursday, around 1:05 a.m., for emergency maintenance. By Thursday afternoon the company had confirmed that customer information had leaked. Restoration work was continuing, with no return time given.
What makes this story harder to tell honestly is what happened the same day. On Thursday morning, Docomo's standalone 5G service suffered nationwide disruptions from around 11:18 a.m. across Japan. The carrier said it had found no signs that the problems were caused by a cyberattack and was investigating the cause. The breach and the outage landed within hours of each other, on the same carrier, on the same day — and neither the company nor the reporting connects them. That is the correct discipline: two bad things happening at once is not evidence of one cause, and a carrier that refuses to link them before the evidence does is doing its job.
The Docomo breach does not arrive in isolation. On October 29, Sony Network Communications said hackers stole roughly 2.6 million subscriber records from its So-net internet service, including about 443,500 records belonging to NTT Docomo customers on a wireless plan — a separate breach, through a different company, a week earlier. Macnica Security counts 119 breach disclosures involving personal information leaks from Japanese networks through October 6, with 81 announced since July. It is a national cluster of customer-data exposures, and Docomo is the largest name in it so far.
What actually failed
This is a story about where identity data concentrates. The "My docomo" portal is, for tens of millions of subscribers, the front door to their mobile identity: it knows your name, address, date of birth, and number, and can change your plan and billing. A portal like that is verified, audited, and patched on a schedule; the data behind it sits there continuously. The gap between those two rhythms — continuous exposure, periodic assurance — is the gap an attacker only needs once.
The second failure is in the communications, not the intrusion itself. Docomo has confirmed a leak of up to 300,000 records while still investigating whether payment data was involved — an honest statement of an unfinished investigation that leaves customers told enough to worry, not enough to act precisely. The company's advice — do not hand card details or passwords to anyone contacting you about this — is the right advice for exactly that uncertainty, because the first thing that follows a leak of real personal details is phishing that uses them to look legitimate.
Third, the 5G disruption: a carrier can have two simultaneous crises with different causes, and the public conversation will try to merge them. The disruption's cause is under investigation and Docomo says there are no signs of a cyberattack behind it. Until evidence says otherwise, the honest account keeps them separate — and the honest lesson is that resilience is tested by coincidence as much as by attack: a portal breach and a network outage on the same day strain the same response teams and the same public trust, whether or not they share a cause.
How Redthread is built for this class of failure
Say this plainly first: Redthread does not secure telecom portals, did not assess NTT Docomo, and nothing below claims we would have prevented this breach or restored the 5G service. The honest mapping is to the pattern — the portal holding identity data, the continuous-versus-periodic gap, the phishing that follows — and to the design principle that narrows it.
The assessment platform (redthreadsec.com) is agentless and AI-native, and it starts from the question this breach forces every organization to ask: where does sensitive identity data actually live, including in customer-facing portals, and what paths reach it? It builds one context graph of your whole estate — the Redthread Flow — covering agents, applications, code, cloud accounts, identities, controls, and the data they can reach. The free self-serve estate scan (Assess & Consolidate) — nothing to install — shows your AI and agent footprint, shadow-AI, cloud posture and sensitive-data exposure (DSPM), and cross-cloud attack paths, ranked first. Our exploit-validation engine actually exercises weaknesses, pentesting AI applications and agents against the OWASP LLM Top 10 as mapped to MITRE ATLAS, with a reproducible proof of concept for every finding. Evidence, never inferred. CI/CD gating blocks merges that introduce proven attack paths, continuous re-assessment catches drift, and results roll up into reports and Letters of Attestation mapped to the frameworks your auditors ask about.
The Agentic Trust & Protection Platform — ATPP (trust.redthreadsec.com; in the console, Agent Trust & Enforce) applies the same principle to machine authority: cryptographic agent identity (SPIFFE) bound to builds, call-time verification of identity and tool claims jointly, attenuating delegation with signed receipts, revocation that propagates when a tool drifts, signed trust-state events that orchestrators, gateways, and SIEMs can react to in seconds, and a daily signed scan of the MCP registry — our November 1 scan covered 54,513 servers and found 1,509 listing swaps — anchored in the public Sigstore Rekor transparency log, with our Enforce gateway, currently in preview, putting these checks in-path, and hooks for Claude Code and Cursor that check each MCP tool call against the server's signed claim before it runs. Its relevance here is the principle: trust decisions need to fire at machine speed, at the moment of use, not at the next review — and when two incidents land on the same day, the record of what was verified, when, and by whom is what lets you keep them honestly separate.
What Redthread does NOT claim
Plainly: we do not claim Redthread would have prevented this breach, that the 5G disruption is connected to it — Docomo says there are no signs of a cyberattack behind the outage — or that the number of affected customers will stay at 300,000, an upper estimate while its investigation continues. We do not claim payment data was compromised; Docomo says that is still under investigation. What we claim is the pattern-level lesson: a customer portal is a concentration of identity data exposed continuously and assured periodically, and the only honest answer is continuous, evidence-based verification of where the data lives and who can reach it. If you are a Docomo customer, the company's advice stands regardless: expect phishing that uses your real details, and never provide card details or passwords in response to an unsolicited message.
Build it with us
We are opening two to three founding design-partner slots: a free 30–45-day pilot — estate scan, cryptographic identity and call-time verification on one live workflow, detect-only, plus the attestation evidence your auditors keep asking for — with deeply discounted, locked founding pricing after.
If a customer-facing portal in your estate holds identity data for hundreds of thousands of people — and it does — start with the free estate scan at redthreadsec.com, or come straight to us about a design-partner slot.
Sources: Jiji Press via Nippon.com, "NTT Docomo Faces Massive Data Breach due to Cyberattack," Nov 5, 2026; Kyodo News, "NTT Docomo reports nationwide 5G service disruptions," Nov 5, 2026; The Japan Times, "NTT Docomo faces network glitches," Nov 5, 2026; CyberRisk Alliance / CU Infosecurity, "Sony ISP Breach Exposes 2.6 Million User Records," Oct 29, 2026.