[Contained][Severity: Major][Unknown]

NTT Docomo: 344,213 users’ phone numbers and identifiers shared with Amazon without consent

Missing consent text led Docomo to share 344,213 users’ phone numbers and identifiers with Amazon. Amazon deleted the unused data; the ministry issued guidance.

Disclosed

2026-11-06

Organizations involved

Leaked or at risk

344.2K

344,213

Downtime

Unknown

Missing consent disclosure

The ministry instructed NTT Docomo after online applications for docomo MAX and other plans omitted third-party-sharing consent text. Phone numbers and user identifiers for 344,213 people were sent to Amazon without valid consent. This concerns the consent process, rather than a cyberattack. [1]

Amazon reportedly deleted the data before using it, and no secondary harm is confirmed. The ministry requires improvements to consent screens and internal checks, with a follow-up report. [1]

Timeline

Disclosed 2026-11-06
1 days

Attack or cause

Method: [Unknown]
Impact: [Data leak]
Entry point: Unknown

Data exposed or at risk

[Phone number][Member or customer ID]

Services hit

[Breached][Major]
docomo MAX

Service	Role	Impact level	Note
docomo MAX	[Breached]	[Major]

Organizations involved

[Breached][Major]Tokyo, ChiyodaInformation and communications344,213 leaked
NTT DOCOMO, Inc.

						Note
NTT DOCOMO, Inc.	[Breached]	[Major]	Tokyo, Chiyoda	Information and communications	344,213

Sources

[1][Regulator]特定利用者情報の保護に向けた措置について（指導）Ministry of Internal Affairs and Communications · 2026-11-06