NTT Docomo Sent 340,000 Customer Records To Amazon Without Consent
The leak traces to a single omitted setting in a February update to the online contract display, which means the consent step stayed missing for roughly six months of signups before anyone caught it.
Reporting from 1 source: ASCII.jp.
NTT Docomo said on September 16 that it provided roughly 340,000 pieces of user personal information to Amazon Japan without user consent. The data covers 340,421 lines from people who signed up for certain rate plans online between April 21 and August 20, and included phone numbers and rate plan names. Amazon has deleted the information. Docomo traced the cause to a configuration error on its side.
The information involved phone numbers and rate plan names, not payment details. The affected signups came through online contracts for certain rate plans between April 21 and August 20, a span of about four months during which the consent step was absent.
Docomo points to a February update of the display content for online contracts, where the setting for the mechanism that obtains user consent for providing information to Amazon was left out. Amazon has deleted the data it received.
Synthesized by Yomimono from the 1 cited source below, including Japanese-language reporting where cited, then editorially reviewed before publishing.