SHINDO5

docomo

NTT DOCOMO, INC.

Mobile lines344,213accounts

LEAK CONFIRMEDPhone number / Membership type / planMisconfiguration · Contained

Open in the live monitor ▶
Disclosed
Sep 16, 2026
Detected
Aug 18, 2026
Detection to disclosure
29 days
Leak
Leak confirmed
Type
Misconfiguration
Status
Contained
Security spend
Not checked yet
Compensation
Not announced

What leaked

ContactPhone number
Account dataContracted plan name

How many

  • Mobile lines 344,213 accounts

Who is affected

  • Affected subscribers

Cause

During a February 25 revision of the important-terms explanation, the wording that obtained consent for third-party provision was deleted by mistake ("human error in deleting an item that should not have been deleted"). As a result, from April 21 phone numbers and plan names were provided to Amazon Japan without consent

Timeline

  1. Provision without consent began
  2. Detected
  3. Exposure ended
  4. Reported to authority
  5. Individuals notified
  6. First disclosure

Response

  • Change process
  • Notified individuals
  • Data deleted

Restored the consent wording on the procedure screen on August 20. Amazon Japan deleted the provided data by September 12. Affected subscribers were notified individually by SMS

What you should do

  1. Treat refund or apology calls and texts as scams. Call back only on the number from the official site
  2. Check the company's notice to see if you're affected

Lessons for companies

  1. Two-person review and pre-release tests for sharing and cache changes; monitor cloud config (CSPM)
  2. Never sit on a known defect. Test every change before production
  3. Report to the PPC: preliminary in 3–5 days, final in 30 (60 if malicious)
  4. Run red teaming and AI-assisted hardening, and publish how much you invest

Sources