TrustBank, which runs Furusato Choice (ふるさとチョイス), Japan's large furusato nozei (hometown tax donation) portal, said on Oct 20 that a third party accessed its member database and that donors' personal data was taken. According to the notice, staff noticed unusual access patterns on Mon Oct 19, then found that the unauthorized access had happened on Sat Oct 17. TrustBank stopped Furusato Choice and related services at 15:50 JST on Oct 19 (2:50 AM ET). Donations through Furusato Choice and its partner sites are suspended, and there is no restart date yet.

Confirmed so far: 4,454,097 member records containing name, email address, postal address, phone number, hashed password and the donor's estimated tax-deduction amount. TrustBank says the count and fields may change as the investigation goes on. It reported the incident to Japan's Personal Information Protection Commission on Oct 20 and plans to file a police report on Oct 21. The notice refers to a vulnerability it detected through the intrusion but doesn't describe it. Several prefectures and cities, including Shiga Prefecture and Saga City, have posted their own warnings to donors.

Do now: if you or your staff use Furusato Choice, change the password anywhere else the same email and password pair is used. The hashes may be cracked, and TrustBank itself asks for this. Expect well-targeted phishing: the attacker has real names, addresses and donation-related amounts, which makes fake "refund", "tax certificate" or "re-registration" emails, texts and letters convincing. Security teams in Japan may want to warn staff, since lures themed on hometown tax are easy to aim at anyone.