Trustbank · Breach

Furusato Choice: 4,454,097 records leaked, card pages accessed for two donors

Oct 16, 2026 · 1 min read

Trustbank (CHANGE Holdings) confirmed unauthorised access that leaked 4,454,097 member records from the Furusato Choice donation platform: names, email addresses, addresses, phone numbers, hashed passwords and estimated donation-deduction amounts. An October 23, 2026 report widened the case: five donors had extra data exposed and two had their saved-card display page accessed by a third party. Trustbank has been notifying members by email since October 21 and the investigation continues with outside specialists.

By HIFY Radar newsroom Updated 10/26/2026 01:25 PM Get this every day →← Back to the feed 4 sources

CriticalBreachNo software to update

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

Trustbank, a CHANGE Holdings subsidiary, confirmed unauthorised access to the Furusato Choice donation platform. The breach exposed 4,454,097 member records: names, email addresses, addresses, phone numbers, hashed passwords and estimated donation-deduction amounts. A follow-up report dated October 23, 2026 confirmed third-party access to the saved-card display page of two donors.

Why it matters

Personal data of millions of Japanese donors is exposed, including hashed passwords. For two donors, third parties saw the last four card digits, the cardholder name and the expiry date; CHANGE Holdings says those details alone cannot make a card payment. The effect on results for the fiscal year ending March 2027 is still being examined, with no cost figure given.

What to do

Check the email Trustbank has sent since October 21, 2026 telling each member whether their data was affected and which items. The five donors with extra exposure were contacted individually. Change the Furusato Choice password and watch card statements.

For the technical team

Affected: Trustbank (CHANGE Holdings) Furusato Choice (site de doações) · 4,454,097 Furusato Choice member records: names, email addresses, addresses, phone numbers, hashed passwords and estimated donation-deduction amounts. For five donors (already inside the total): point history (five), donation history and date of birth (two each), delivery address (one).
Exploitation: Breach confirmed by Trustbank and CHANGE Holdings themselves in a notice and a market disclosure. No mention of PoC, KEV or attacker group; this is not a software flaw.
Fix: No patch applicable. Trustbank contacted the five donors with extra exposure individually and has emailed members since October 21, 2026 to say whether their data was affected and which items. The investigation continues with outside specialists and new findings will be disclosed once confirmed.
Vector: Unauthorised access to the Furusato Choice donation platform system run by Trustbank. The intrusion method is not described in the sources. For the two card cases, access happened on the saved-card display page inside the member account.
More details: First report on October 20, 2026; second report on October 23 widened exposure for five donors with the total unchanged. The card page shows only the last four digits, the name and the expiry date, pulled from the payment processor each time it is opened; CHANGE Holdings says Trustbank does not store those details and they alone cannot make a card payment. One of the five donors had the prefecture name of the registered address deleted. Disclosure metadata lists the incident start as October 17, 2026. Impact on consolidated results for the fiscal year ending March 2027 is still being examined.