NTT Docomo: up to ~300k customer records leaked from My docomo / Online Shop
https://sockanalyst.com/patch-now/ntt-docomo-my-docomo-online-shop-breach

Splunk
index=email OR index=proxy OR index=dns ("docomo" OR "My docomo" OR "ドコモ" OR subject="*docomo*" OR url="*docomo*")
| eval lookalike=if(match(url,"(?i)docomo") AND NOT match(url,"(?i)(\.|^)docomo\.ne\.jp"),"yes","no")
| where lookalike="yes" OR match(subject,"(?i)(password|reset|maintenance|緊急|不正)")
| stats count min(_time) as first max(_time) as last values(src_user) as senders values(url) as urls by subject, recipient

Sentinel
EmailEvents
| where TimeGenerated >= ago(14d)
| where Subject has_any ("docomo","My docomo","ドコモ","不正アクセス","緊急メンテナンス")
    or SenderFromDomain has "docomo"
| where SenderFromDomain !endswith "docomo.ne.jp" and SenderFromDomain !endswith "nttdocomo.com"
| summarize Emails=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated),
    Subjects=make_set(Subject,10) by SenderFromAddress, SenderFromDomain, RecipientEmailAddress
| order by Emails desc