The Field Briefing — Issue #019 November 5, 2026 · From the Red Flag Cyber research desk

Next issue: The desk is watching for NTT Docomo's finding on whether payment card details or My Number national identification numbers were also leaked — both are still under investigation — and for SMBC Consumer Finance to finish identifying who is affected and send individual notices through its partner banks.

DEEP DIVE

NTT Docomo breach: personal information on up to about 300,000 customers leaked through the online shop and My docomo

The Short Version: NTT Docomo confirmed on November 5, 2026 that unauthorised access to the Docomo Online Shop and My docomo leaked personal information on up to about 300,000 customers, including names, addresses, dates of birth and phone numbers. The company confirmed the unauthorised access on November 4 and suspended both services for emergency maintenance from about 1:00 a.m. on November 5. Whether payment card details or My Number national identification numbers were also leaked is still under investigation, and Docomo says it will notify affected customers promptly as the details are established. Docomo has not said that passwords were leaked.

What to do now: - Wait for Docomo's own notice about whether your information is included, and reach the company only through its official app, its official website typed in yourself, or a number you already have — never through a link or number supplied by an unexpected call, email or text about this breach. - Do not enter a password or credit card details on any page a message sends you to; Docomo itself urges customers not to enter card information or passwords in suspicious emails. - If a caller claims to be Docomo and asks you to confirm personal details, hang up and call back on the official number. - Keep an eye on your mobile account for contract changes you did not request, and on bank and card statements while the payment-card question remains open.

Full report: https://red-flag-cyber-site.andrewdpeat.workers.dev/news/ntt-docomo

RED FLAG OF THE WEEK

A caller who can quote your real loan amount, your income or your driver's licence number is not proven to be your bank. The SMBC Consumer Finance breach sent exactly that kind of data outside the company, and quoting real details is what that data enables. No bank needs you to confirm those details on an inbound call — hang up and call your bank on a number you already trust.

Source: https://red-flag-cyber-site.andrewdpeat.workers.dev/news/smbc-consumer-finance

This issue covers items published November 3 – November 5, 2026.

NEWS

SMBC Consumer Finance breach: card-loan guarantee data on up to 320,118 people sent out, including driver's licence numbers, incomes and loan amounts

SMBC Consumer Finance announced on November 5, 2026 that unauthorised access to its card-loan guarantee system sent data on up to 320,118 people outside the company, including names, dates of birth, addresses, phone numbers, driver's licence numbers, employers, annual incomes and guaranteed loan amounts. The data went out through a guarantee provider, so many affected people may never have dealt with SMBC Consumer Finance directly — their own bank's name is the one a scammer is most likely to use. The company plans to notify affected customers individually by email or SMS once the scope is identified; treat every such message as a claim to verify, go to your bank through its official app or a number you already trust, and check your statements for a new loan, guarantee or account change you did not request.

SMBC Consumer Finance breach: card-loan guarantee data on up to 320,118 people sent out, including driver's licence numbers, incomes and loan amounts | Red Flag Cyber

SMBC Consumer Finance announced on November 5, 2026 that unauthorised access to its card-loan guarantee system sent data on up to 320,118 people outside the company, including names, dates of birth, addresses, phone numbers, driver's licence numbers, employers, annual incomes and guaranteed loan amounts.

mSecure breach: encrypted Cloud database taken, customers told to change passwords, reset two-factor authentication and remove passkeys

mSeven Software warned current and former mSecure customers on November 3, 2026 that an unauthorised actor had acquired an encrypted copy of a database of mSecure Cloud users. The company reports no evidence the encrypted contents were accessed and has given no affected count; the incident covers mSecure Cloud sync only, as the company describes it. Follow mSeven's own advice, inside the app or on a website address you type yourself: change your mSecure master password to a long, unique passphrase, change the important passwords stored in the vault, reset two-factor authentication for accounts whose codes or secrets were stored in mSecure, and remove passkeys stored in the app and create them again.

mSecure breach: encrypted Cloud database taken, customers told to change passwords, reset two-factor authentication and remove passkeys | Red Flag Cyber

mSeven Software warned current and former mSecure customers on November 3, 2026 that an unauthorised actor had acquired an encrypted copy of a database of mSecure Cloud users; the company reports no evidence the encrypted contents were accessed and has given no affected count.

VIDEO

Episode 036: Is the mSecure breach real? What to do

New Short: the mSecure breach is confirmed by its maker — change the master password, change the big passwords stored inside, and reset two-factor.

Watch: https://www.youtube.com/shorts/rlkZ35AW2zs

Full report: https://red-flag-cyber-site.andrewdpeat.workers.dev/news/msecure

WHAT YOU LEARNED TODAY

Reach Docomo and your bank only through official apps and numbers you already have, never through a breach message; a caller quoting real loan or licence details is not proven genuine; and if you ever synced through mSecure Cloud, change the master password, the important stored passwords, reset two-factor and recreate passkeys.

Forward this to ONE person who needs it today

👍 Good / 😐 Just OK / 👎 Terrible

—

Red Flag Cyber research desk

Masked and alias email addresses are welcome — subscribe with whatever address you're comfortable with. We never sell your data.