Docomo data leak exposes account details as Japan examines cyber threats

An emergency apology over customer records leads into reporting on fake job applicants and malware disguised as a meeting-app update.

Channel: Nippon TV News ·

JapanStory of November 9, 2026Trari Newsroom

Why this story? One of 日テレNEWS's most watched videos since yesterday, with 480,000 views.

日テレNEWS: The news division of Nippon TV, a Japanese commercial television network. 3.4M subscribers and 6.4B views.

【サイバー攻撃】NTTドコモ“流出”で緊急会見最大約30万件...口座情報や勤務先も/“約1兆円”被害に「北朝鮮」関与『追跡取材 news LOG』

Things we can learn from the video

Press to jump

0:20Docomo president Yoshiaki Maeda confirms unauthorized access exposed customer information and says compensation is under review.
1:45bitFlyer's Yuzo Kano says North Korean operatives attempted infiltration through fake job applications and remote interviews.
3:14An analyst demonstrates malware delivery disguised as an online meeting application's update.
5:27Former professor Kim Heung-gwang describes selecting talented students for North Korea's hacker training.
7:07Vangelis Stykas recounts monitoring North Korean hacker networks and stresses the operatives' persistence.
9:53Studio guests discuss the resource imbalance between state-backed attackers and the companies or individuals defending against them.

Bank account information and workplace details are among the customer records exposed in an NTT Docomo data breach, according to Japan's Nippon Television News (日テレNEWS). The report says up to about 300,000 records may be affected.

At an emergency press conference on November 6, company president Yoshiaki Maeda apologized and confirmed that unauthorized external access had resulted in customer information being leaked. He said compensation for affected users was under review. Docomo is a Japanese mobile carrier within the NTT group.

The segment then broadens into an investigation of North Korean hacking operations. These are separate strands of the report: it does not establish that North Korea was responsible for the Docomo breach.

In the international section, the report describes a cryptocurrency theft involving Binance that it says the FBI attributed to North Korea, alongside losses put at roughly one trillion yen. It then brings the threat closer to Japanese businesses through an account from Yuzo Kano of cryptocurrency exchange bitFlyer.

Kano says North Korean operatives tried to enter the company through fake job applications and remote interviews. He recalls finding their use of military-style expressions, including acknowledgments equivalent to "yes, sir," unusual. His broader warning is that deceiving an employee can be an easier route into a business than attacking its technology directly.

A cybersecurity analyst demonstrates one such deception: malware presented as an update needed for an online meeting application.

Reporting from South Korea, the team interviews Kim Heung-gwang, a defector and former computer engineering professor who says he trained hackers in North Korea. He describes selecting highly capable students for specialist training. Cybersecurity researcher Vangelis Stykas separately recounts infiltrating and monitoring North Korean hacker networks, emphasizing persistence rather than uniformly exceptional technical skill.

Back in the studio, guests Yoshizumi Ishihara and Patrick Harlan consider the difficulty of defending against an organized state-backed operation. Harlan's central concern is the imbalance when an individual or a company faces the resources of a country.

Published on Trari