NTT Docomo online shop and My docomo breach (up to about 300,000 records): ID document numbers leaked — what customers should do

In its second report of November 5 the company said it would promptly notify affected customers once the details of the leaked information are known. As of the third report, the method and timing of individual notices are not stated.

First check Docomo's official notices for the latest status. The third report lists a special hotline (0120-451-360, 9:00 a.m. to 8:00 p.m., in Japan). Use contacts listed on the official site rather than numbers or links in messages you received.

The company says suspicious emails, SMS messages and calls posing as Docomo or related parties may reach customers using the leaked information. It asks people not to open URLs in the message, not to open attachments, and not to enter or answer with personal information, passwords or credit card details.

Because name, address, contact details, contract details and an ID document number are said to have leaked, a caller who quotes them correctly proves nothing. If you are asked for a PIN, password or verification code for a "procedure" or "account check", do not answer and hang up. How to spot these is covered in What is phishing?

An ID document number is included for all affected customers. The notice does not say which document (a driver's licence, for example), and it does not say that images of documents leaked.

In general, a name, address and date of birth plus a document number can be used for applications that pose as you. As a precaution, consider a self-declaration to the credit bureaus (CIC, JICC and the Japanese Bankers Association's credit centre) and disclose your own credit record to check for contracts you do not recognise. Costs and steps are in What to do when your driver's licence data leaks.

For some customers the company says the financial institution, branch, account number and account holder name leaked. An account number and name are also what you give someone to receive a transfer, and in general they alone do not let anyone withdraw money (our view). Withdrawals and transfers need the cash card and PIN, or internet-banking login details and verification codes.

Watch for contact that uses your account details as a hook while posing as a bank, Docomo or the police. The Japanese Bankers Association says it never asks customers for PINs or passwords. Check your passbook or app for deposits and withdrawals you do not recognise, and contact your bank at once if you find any. We found no official guidance telling people to replace an account only because the number leaked.

For some customers the company says the workplace or company name and address, and the name and contact details of a legal representative or procedure agent, leaked. If your company holds Docomo contracts, tell the person in charge and the staff who use the lines to be wary of suspicious contact posing as Docomo.

If you manage a contract for a minor or an older relative, share this article with them too.

If you sent money in response to a suspicious message, or entered account or card details, contact your bank or card company first.

You can also call the police advice line (#9110) or the Consumer Hotline (188) in Japan. If you typed a password into a fake page, change it at once, and change it elsewhere if you reuse it (How to choose a password manager).