What happened. Trust Bank, which runs Furusato Choice, one of the main portals Japanese taxpayers use to make hometown tax (furusato nozei) donations to local governments, says it noticed unusual access patterns on Monday, Oct 19. Checking them, it confirmed a third party had gotten into member data on Saturday, Oct 17, and that personal information had left the building. Trust Bank shut down Furusato Choice and its related services at 15:50 JST on Oct 19 and published the details on Oct 20. Its parent, CHANGE Holdings (TSE Prime: 3962), filed a matching disclosure the same day.
How big. 4,454,097 member records are confirmed leaked so far. The fields: name, email address, home address, phone number, hashed password and the member’s estimated donation deduction amount. Trust Bank says the count and fields may change as the investigation goes on. How the attacker got in: Undisclosed, beyond the company saying it is working on “the vulnerability detected” in this incident with outside experts. Hashing algorithm: Undisclosed. Restart date: none yet.
What’s been done. Services stay offline until Trust Bank can confirm they’re safe. It reported the incident to Japan’s Personal Information Protection Commission on Oct 20 and plans to file a police report on Oct 21. It is asking members who reused the same email and password elsewhere to change those passwords, and warning about fake emails, texts, calls and mail pretending to be Furusato Choice. Municipalities that rely on the portal, such as Saga City, are already posting notices that donations through it are paused.
Why a security team should care. This isn’t just a consumer breach. Furusato Choice members are working, tax-paying adults, and some will have signed up with the same email they use for work. The estimated deduction amount is a rough income signal tied to a real name and home address, which makes for very convincing tax-season phishing and vishing. It also lands in a bad month for Japan: Nikkei (1.83M records), YMIRLINK’s Cuenote FC (about 9M records) and now this, all disclosed within days of each other.
What we’d check. Watch for credential stuffing against your SSO and customer portals from reused Furusato Choice passwords, and push resets where personal and work credentials overlap. Brief finance, HR and help desk staff on fake “donation refund” or “deduction correction” lures that use real addresses and amounts. If you run a payments or donation platform yourself, this is a good week to check whether your member export paths are rate-limited and alerting, since Trust Bank caught it two days after the access.