Trustbank runs Furusato Choice, Japan's largest portal for the Furusato Nozei hometown-tax donation scheme. The company has confirmed that an unknown third party broke in and copied 4,454,097 member records. That figure appears in Trustbank's own notice dated 20 October 2026 and in the matching disclosure from its Tokyo-listed parent, CHANGE Holdings (3962.T). ASCII.jp, Japan IR and AliasFleet repeat it exactly, and TipRanks rounds it to "approximately 4.45 million". The stolen data includes names, contact details, hashed passwords and estimated tax-deduction amounts. The platform is offline and Trustbank has not given a date for bringing it back.
What Happened
Trustbank's notice gives this sequence:
- 17 October (Sat): A third party gained unauthorized access to member data.
- 19 October (Mon): Trustbank noticed unusual access patterns, investigated, confirmed the 17 October intrusion and found that member data had been taken.
- 19 October, 15:50 JST: Trustbank shut down Furusato Choice and related services to limit the damage. Asahi Shimbun reported the same evening that donations could not be processed.
- 20 October: Trustbank published its notice and finished filing a report with Japan's Personal Information Protection Commission (PPC).
- 21 October: Trustbank planned to file a victim report with local police.
Where accounts differ: The Japan IR summary of CHANGE Holdings' filing says services were suspended at 15:50 "on the same day" as the 17 October intrusion. Trustbank's own notice, ASCII.jp, TipRanks and AliasFleet all put the shutdown on 19 October. This brief treats 19 October as correct. On the police report, TipRanks says the incident has already been reported to police, but Trustbank says the filing was scheduled for 21 October.
The disruption also reached local governments. TBS/Tulip TV reports that Kurobe City in Toyama said its donation portal was unavailable, and suggests every municipality in Toyama Prefecture may be affected. According to Asahi, Furusato Choice lists about 1,700 municipalities and more than 760,000 thank-you gifts.
What Was Taken
Trustbank lists six data fields:
- Names
- Email addresses
- Postal addresses
- Phone numbers
- Hashed passwords (the hashing algorithm and whether salting was used have not been disclosed)
- Estimated donation-deduction amounts (寄附控除試算額)
The deduction estimate is the unusual item. AliasFleet reports TV Asahi's view that this figure can partly reveal a donor's income. That makes the data useful for tailoring fraud and for picking out wealthier targets. AliasFleet also points out that Trustbank has not said whether 4,454,097 is a deduplicated count of people, so "records" is the safer term. Trustbank and CHANGE Holdings both warn that the count and the list of fields may change as the investigation goes on. No source mentions payment card data in this incident.
Why It Matters
- High-value data for targeting. Contact details plus an income signal tied to a government tax scheme is ideal material for phishing that pretends to be the tax office, the city or Trustbank. Peak Furusato Nozei season runs to the end of the year, which raises the risk.
- Password reuse. With hashed passwords and email addresses out, weak passwords can be cracked offline and tried on other sites. Trustbank is telling users who reused the same email and password combination to change it elsewhere.
- Second incident in weeks. Security Measures Lab reports that on 5 October Trustbank disclosed a separate bug in its Amazon Pay checkout flow. Between 13 November 2025 and 7 September 2026, 254 donors' application records (names, addresses, phone numbers, emails and delivery details) could be shown to other users. That was a coding flaw rather than an intrusion and has no known link to this breach. Even so, two disclosures in quick succession raise questions about how the platform's security is managed.
- Part of a wider wave. Asahi's roundup of breaches disclosed on 19 October also covers Hankyu Hanshin Department Stores (about 1.26M H2O ID records), Nifty (up to 540,000 customers), Joshin and Ashikaga City's crematorium booking system. No source connects these to Furusato Choice.
- Financial impact. TipRanks reports that CHANGE Holdings is still working out the effect on results for the fiscal year ending March 2027.
The Attack Technique
Trustbank has not said how the attacker got in, and no threat actor has claimed the attack. The notice refers to dealing with "the vulnerability detected through this unauthorized access", which suggests a specific weakness was exploited, but gives no detail. TipRanks likewise says the company is investigating "the vulnerability". The only detection detail made public is that Trustbank noticed unusual access patterns about two days after the intrusion. External experts are investigating. Until findings are published, any claim about the initial access method, the tooling used or who was behind it is speculation.
What Organizations Should Do
- Treat estimated financial data as sensitive. Fields like tax-deduction estimates reveal income. Encrypt or tokenize them, and keep them out of the main member store where possible.
- Use strong password hashing. Use salted, slow algorithms such as Argon2id, bcrypt or scrypt so that stolen hashes are expensive to crack, and say publicly which one you use.
- Shorten the time to detect. Alert on bulk reads of member tables and unusual export volumes. A two-day gap between intrusion and detection is long enough for a full copy of the database to leave.
- Test error paths. The earlier Amazon Pay bug happened because processing carried on when user identification failed. Code should stop by default when identity checks fail, and tests should cover these failure cases.
- Prepare for phishing that impersonates you. Brief support teams and municipal partners. Publish the official contact channels (Trustbank uses [email protected]). Tell users you will never ask for passwords by email, SMS or phone.
- Force resets and push MFA. When the platform comes back, require password resets, offer multi-factor authentication, and check logins against known breached credentials.
Sources: 4.45 Million Member Records Leaked from Furusato Nozei Site 'Furusa... | CHANGE Holdings,Inc. - Notice of Personal Information Leakage at Co... | CHANGE Holdings Subsidiary Halts “Furusato Choice” After Massive Da... | 「ふるさとチョイス」で個人情報漏えいの可能性―Amazon Pay寄付時に254件の申込データが別利用者から閲覧可能な状態セキュリティ... | Furusato Choice Breach Exposes 4.45 Million Donor Records | 阪急阪神、ニフティ、ふるさとチョイス【19日判明の不正アクセス】 不正アクセス個人情報流出：朝日新聞 | 不正アクセスによる寄附者様情報の外部流出に関するお詫びとお知らせ NEWSROOM 株式会社トラストバンク | 「ふるさとチョイス」不正アクセスで約445万件の個人情報流出 富山県と県内“すべての自治体”にも影響か…再開時期は未定 TBS NE...