CHANGE Holdings (TSE Prime: 3962) disclosed on October 20, 2026 that someone gained unauthorized access to "Furusato Choice," Japan's large hometown tax donation portal. The platform is run by Trust Bank (styled TRUSTBANK in some coverage), a consolidated subsidiary. Personal data on 4,454,097 members leaked outside the company, according to the company's notice as reproduced by Japan IR. TipRanks' auto-generated newsdesk rounds this to "approximately 4.45 million registered donors," so the two figures agree. The leaked data includes names, contact details, hashed passwords and estimated tax deduction amounts. The service is offline, and no restart date has been set. No threat actor has claimed the attack, and the company has not said how the attacker got in.
What Happened
The company's account, as carried by Japan IR, says unauthorized access to Furusato Choice was confirmed on October 17, 2026. Related services were suspended at 15:50 the same day. TipRanks says the service was suspended on October 19. The two accounts differ on this date. Japan IR reproduces the company's notice directly, so we give more weight to October 17. The October 19 date may refer to a later or wider shutdown, but no source says so.
Both sources agree on the response so far:
- Trust Bank is investigating the cause and scope with outside experts.
- The incident has been reported to Japan's Personal Information Protection Commission (PPC). TipRanks adds that it was also reported to the police.
- The company will notify affected individuals. TipRanks says it has set up an inquiry desk for donors.
- Trust Bank will decide when to restart the service only after it confirms the platform is safe.
- TipRanks says management is still assessing the financial impact on results for the fiscal year ending March 2027.
The company says the figures and data types are only what it has confirmed so far and "may change as the investigation proceeds." Treat 4,454,097 as a number that could still rise.
A note on sourcing: every source supplied for this brief is tagged OTHER-tier. The strongest one is Japan IR's English reproduction of the company's own disclosure. We have not reviewed the original Japanese TDnet filing. No security outlet, CERT or regulator account was available at the time of writing.
What Was Taken
The company's notice lists these member data types as possibly leaked:
- Full name
- Email address
- Postal address
- Phone number
- Hashed password
- Estimated donation deduction amount
The last item is the unusual one. Furusato nozei donors receive tax deductions, and the estimated deduction amount gives a reasonable proxy for the donor's income bracket. A list of 4.45 million names and home addresses, sorted by how much disposable income each person has, is very useful for targeted fraud.
The notice does not name the hashing algorithm or say whether the hashes were salted. If the hashes are weak or unsalted, attackers can crack many of them offline. TipRanks reports that the company is warning donors who reused their Furusato Choice password elsewhere to change it, which implies the company sees credential stuffing as a real follow-on risk. Neither source mentions payment card data.
Why It Matters
Scale and timing. Furusato Choice is one of Japan's main hometown tax portals. Donations in that market tend to spike toward the end of the calendar year, so an outage starting in mid-October falls at a bad time for both the platform and the municipalities that depend on it. TipRanks reports that financial impact is still being assessed.
Phishing material. Name, address, phone and email, combined with confirmed membership of a tax donation service, is ideal for lures. Expect fake "deduction certificate," "refund," and "account re-verification" messages by email, SMS and phone. TipRanks reports that the company is already warning donors about phishing.
A pattern of subsidiary breaches. This disclosure came one day after Toho Holdings (8129) reported, also through Japan IR, unauthorized access to a database at its subsidiary EnTouch. In that case, healthcare professionals' names, affiliations and reservation contact details leaked, and the number of affected records is still unknown. Shinhan Financial Group's Form 6-K, summarized by StockTitan, separately discloses that an outside party accessed Shinhan Bank services and obtained customer information. We have no evidence linking these incidents. What they share is a breach at a subsidiary platform, disclosed by the listed parent, with scope still unknown at the time of disclosure. Defenders at holding-company groups should treat subsidiary-run consumer platforms as part of their own attack surface.
Do not confuse this with Change Healthcare. Several sources in this set (ORION Labs, Undercode News, the Third Party Threat Hunters podcast) cover Change Healthcare, the UnitedHealth/Optum unit breached in February 2024. That company is unrelated to Tokyo-listed CHANGE Holdings. Undercode reports that a 201GB dataset allegedly belonging to Change Healthcare was advertised on October 20, 2026, the same day as this disclosure, and notes that the listing is unverified and may be recycled 2024 data. Analysts tracking either incident should filter carefully so the two do not get mixed up in feeds and alerts. The same applies to the VIVOTEK/Delta Electronics Everest ransomware claim reported by FTV News via Yahoo Taiwan, which is a separate incident.
The Attack Technique
Not disclosed. The company describes only "unauthorized access." TipRanks says the investigation is looking at "the vulnerability," which hints at an exploited flaw rather than stolen credentials, but the company's own notice does not confirm this. No ransomware group or other actor has publicly claimed the attack in the sources we reviewed, and no indicators of compromise have been released.
The Change Healthcare case offers a general lesson for defenders, though it should not be read as a description of this incident. ORION Labs, citing UnitedHealth's Senate testimony and the State of Nebraska's lawsuit, describes how a single support account with only a password, on a Citrix portal without MFA, led to about nine days of undetected movement inside the network before ransomware went off. That pattern is common in large consumer platform breaches: a low-privilege foothold, unmonitored internal movement, then bulk data theft. Until Trust Bank publishes its findings, any claim about the specific attack path is speculation.
What Organizations Should Do
- Enforce MFA on every remote access and admin path to customer databases. This includes support and low-privilege accounts, which was the central failure in the Change Healthcare case.
- Watch for bulk data movement, not just intrusions. Alert on unusually large queries or exports from member tables, and on data going to new destinations. This is how theft of millions of records can be caught while it is still happening.
- Upgrade password storage and plan for credential stuffing. Use a modern, salted, memory-hard hash such as Argon2id or bcrypt. If you run a consumer login, expect lists of Furusato Choice emails to be tried against your service. Turn on breached-password checks and rate limiting now.
- Apply group-level security standards to subsidiary platforms. Parent companies should audit consumer-facing subsidiaries against the same controls as core systems. The CHANGE/Trust Bank and Toho/EnTouch disclosures both show the parent carrying the disclosure and market impact.
- Prepare anti-phishing messages before notifying customers. Tell members in advance exactly which channels you will use to contact them and what you will never ask for. For Japanese tax-related services, warn specifically about fake deduction certificate and refund messages ahead of year-end.
- For affected individuals: change any password reused from Furusato Choice, be suspicious of unexpected calls or messages that mention your donations, and check that any notice claiming to come from Trust Bank or CHANGE Holdings actually came through official channels.
Sources: CHANGE Holdings,Inc. - Notice of Personal Information Leakage at Co... | CHANGE Holdings Subsidiary Halts “Furusato Choice” After Massive Da... | 獨家／台達電認了！「前安控股王」被駭 56頁技術報告曝光 | How One Stolen Login Exposed Data on 192.7 Million People at Change... | Change Healthcare: 201GB of Alleged Internal Data Advertised on the... | Toho Holdings Co., Ltd. Notice: Data Leakage Due to Unauthorized Ac... | Shinhan Financial reports Shinhan Bank data incident SHG SEC Filin... | Change Healthcare and the Concentration Risk Nobody Chose, with Kay...