# Furusato Choice (Trustbank): 4,454,097 donor records leaked after unauthorized access · pwn.watch

> Trustbank, operator of Japan's Furusato Choice hometown-tax donation site, says unauthorized access on Oct 17 2026 leaked 4,454,097 member records: names, email and postal addresses, phone numbers, hashed passwords and estimated donation-deduction amounts. Services were suspended on Oct 19. A later update found five donors had more data exposed, including saved-card display details (last four digits, name, expiry) for two of them.

Page: https://pwn.watch/i/furusato-choice-trustbank-data-breach-oct-2026 · generated 2026-10-24T08:44:16.553Z

## Status
- Severity: high · status: live · patch: no-fix-needed
- Product: Furusato Choice (Trustbank, CHANGE Holdings)
- Started: 2026-10-17
- Affected: 4,454,097 Furusato Choice member records

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/furusato-choice-trustbank-data-breach-oct-2026/feed.xml
- JSON Feed: https://pwn.watch/i/furusato-choice-trustbank-data-breach-oct-2026/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/furusato-choice-trustbank-data-breach-oct-2026.json
- This file: https://pwn.watch/i/furusato-choice-trustbank-data-breach-oct-2026/llms.txt

## Updates (newest first)
- 2026-10-23: Update: five donors had extra data exposed, including saved-card display details for two; the total count is unchanged. (https://tokyobrief.com/articles/furusato-choice-breach-five-donors-more-data)
- 2026-10-20: Trustbank and parent CHANGE Holdings disclose 4,454,097 leaked member records. (https://fs2.magicalir.net/tdnet/2026/3962/20261020553747.pdf)
- 2026-10-19: Trustbank suspends Furusato Choice services pending safety checks. (https://www.trustbank.co.jp/newsroom/newsrelease/news261020/)
- 2026-10-17: Unauthorized access to Furusato Choice systems. (https://www.trustbank.co.jp/newsroom/newsrelease/news261020/)

## Fix brief
# Security brief: Furusato Choice (Trustbank): 4,454,097 donor records leaked after unauthorized access

Source: https://pwn.watch/i/furusato-choice-trustbank-data-breach-oct-2026 · status: live · severity: high · updated Oct 24, 2026, 06:40 UTC

## Patch status
**NO FIX NEEDED: no action on your side beyond verification.**

## What it is
Trustbank, operator of Japan's Furusato Choice hometown-tax donation site, says unauthorized access on Oct 17 2026 leaked 4,454,097 member records: names, email and postal addresses, phone numbers, hashed passwords and estimated donation-deduction amounts. Services were suspended on Oct 19. A later update found five donors had more data exposed, including saved-card display details (last four digits, name, expiry) for two of them.

Severity detail: 4.45M records including hashed passwords and addresses

- Product: Furusato Choice (Trustbank, CHANGE Holdings)

## Affected versions
- 4,454,097 Furusato Choice member records

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
No fixed version is listed. Follow the vendor advisory below.

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Specific notes
Furusato Choice users should change their password there and anywhere it was reused, and watch for phishing that cites donation details.

## Latest updates
- Oct 23, 2026: Update: five donors had extra data exposed, including saved-card display details for two; the total count is unchanged.
- Oct 20, 2026: Trustbank and parent CHANGE Holdings disclose 4,454,097 leaked member records.
- Oct 19, 2026: Trustbank suspends Furusato Choice services pending safety checks.
- Oct 17, 2026: Unauthorized access to Furusato Choice systems.

## Advisories
- [不正アクセスによる寄附者様情報の外部流出に関するお詫びとお知らせ](https://www.trustbank.co.jp/newsroom/newsrelease/news261020/) (Trustbank)
- [CHANGE Holdings timely disclosure (TDnet, PDF)](https://fs2.magicalir.net/tdnet/2026/3962/20261020553747.pdf) (CHANGE Holdings)

## Write-ups & news
- [ふるさと納税仲介サイト「ふるさとチョイス」、個人情報４４５万件超が流出](https://www.yomiuri.co.jp/national/20261020-GYT1T00318/)
- [Furusato Choice breach widens for five donors, with card details accessed for two](https://tokyobrief.com/articles/furusato-choice-breach-five-donors-more-data)

---
Machine-readable: https://pwn.watch/i/furusato-choice-trustbank-data-breach-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.