Furusato Choice Review: Trustbank Security After October 2026 Donor Records Leak

Furusato Choice review starts with the facts of the October 2026 incident at Trustbank, Inc. Unauthorized access on October 17 exposed 4,454,097 member records. The platform, which handles Japan's furusato nozei donation system, remains largely suspended while investigations continue.

What Happened in the Furusato Choice Data Breach

Trustbank detected unusual access patterns on October 19 and suspended related services that afternoon. The company issued its first public notice on October 20 and reported the incident to Japan's Personal Information Protection Commission the same day. Police were consulted on October 21. All member passwords were invalidated immediately after detection.

The main scope of leaked data includes names, email addresses, postal addresses, phone numbers, hashed passwords, and estimated donation tax deduction amounts. A smaller set of five donors had additional details exposed, such as point history for five individuals and donation history for two. Credit card details limited to the last four digits, cardholder name, and expiration date appeared for two donors. Full card numbers were not involved.

Trustbank stated that no leakage occurred for donations completed on partner sites. The company is working with external experts to identify the cause and improve monitoring.

Trustbank Response and Service Status

Trustbank and its parent CHANGE Holdings issued apologies in official releases. The firm continues to investigate the full scope and has implemented password resets across all accounts. Donor-facing services on the main platform stay suspended as of late October 2026 pending safety verification. The donation management system for municipalities and vendors resumed gradually from October 26. Partner-site linkage returned on October 28, with donation acceptance resuming at each partner's discretion.

Company guidance advises users to change passwords on any other services sharing the same credentials. Recipients should monitor for suspicious emails, SMS messages, or calls that impersonate the service. Inquiries must route through official channels only. No specific compensation program has been announced yet, and potential effects on fiscal year 2027 results remain under review.

Service resumption will occur in phases once full safety is confirmed. Further disclosures are expected as the investigation progresses. Municipal partners have posted their own notices directing donors to Trustbank updates.

Implications for Users and Next Steps

Anyone who used Furusato Choice should treat the leaked email and password combination as compromised. Hashed passwords reduce immediate risk, yet the exposure of names, addresses, and phone numbers increases phishing potential. Users should watch account activity on linked financial services even though full card numbers stayed protected.

The platform's gradual reopening focuses first on backend systems for local governments. Full donor access on the primary site awaits independent verification of fixes. Ongoing monitoring by external specialists will determine when additional features return.

Trustbank has committed to strengthening security controls and information management practices. Individuals affected by the limited additional data leaks received direct notifications. Regular checks of official Trustbank newsroom releases provide the clearest updates on timelines and further findings.