Breach · · 3 min read
Furusato Choice breach: 4.45 million donor records taken from Japan’s hometown tax site
Trustbank, which runs Japan’s Furusato Choice donation site, says 4,454,097 member records were taken, including hashed passwords. Parts of the site are reopening.
Furusato Choice is one of the biggest sites for Japan’s hometown tax donations, where people give to a town of their choice and get a tax deduction and a thank-you gift. Its operator, Trustbank, says an attacker took millions of member records, including hashed passwords. If you have a Furusato Choice account, here’s what is known and what to do.
What happened
Trustbank says it spotted unusual access on October 19, 2026, found that someone had broken in on October 17, and shut down Furusato Choice services that afternoon, according to its first notice (in Japanese). It reported the breach to Japan’s Personal Information Protection Commission the next day.
The data confirmed as taken covers 4,454,097 member records:
- name, email address, postal address and phone number
- a hashed password
- the estimated donation deduction amount
In a second report on October 23, parent company CHANGE Holdings said that for five of those members, more was seen, such as point and donation history and dates of birth, Tokyo Brief reported. For two of them, the page showing a saved card’s last four digits, name and expiry date was accessed. The company says that information alone can’t be used to make a payment. Trustbank began emailing members on October 21 to tell them whether they were affected.
On October 28, CHANGE Holdings said some Furusato Choice operations had restarted after safety checks and that donations would reopen gradually, Japan IR reported.
What this means for you
A hashed password isn’t the password itself, but weak passwords can sometimes be worked out from their hashes. That matters most if you used the same email and password somewhere else. The address and phone details also make convincing scams easier, especially around tax season and donation deadlines.
What you can do
- Change your password on any other site where you used the same one as Furusato Choice. Trustbank asks members to do this.
- Set a new, unique password for Furusato Choice when you next sign in, and keep it in a password manager.
- Be careful with emails, texts, calls and letters that claim to be from Trustbank, a town or the tax office. Don’t open links or attachments in unexpected messages; go to the site yourself.
- Check your card statements if you saved a card on the site, though the company says card details alone can’t be used to pay.
- Learn the patterns. See how scammers use leaked data.
How Frame helps
Add this breach to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Automatic breach lookups aren’t live yet. Frame’s email aliases also let you give each site its own address, so a leak at one doesn’t lead scammers straight to your main inbox. Frame never collects or stores the leaked records themselves.
Sources
- Trustbank, 不正アクセスによる寄附者様情報の外部流出に関するお詫びとお知らせ (in Japanese), October 20, 2026
- Tokyo Brief, Furusato Choice breach widens for five donors, with card details accessed for two, October 23, 2026
- Japan IR, CHANGE Holdings: Notice on Personal Information Leakage at Consolidated Subsidiary (4th Report), October 28, 2026
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.