---
title: Furusato Choice breach: TrustBank says an attacker took 4,454,097 donor accounts (names, addresses, phones, emails, hashed passwords, tax-deduction estimates) from Japan's hometown-tax portal; donations are suspended | ctxsec
url: https://ctxsec.com/items/furusato-choice-trustbank-4-45m-breach
description: "TrustBank, operator of the Furusato Choice hometown-tax donation portal, says an Oct 17 intrusion exposed 4,454,097 member records including hashed passwords. It shut the service at 3:50 PM JST on Oct 19 and has no restart date."
status: "confirmed (TrustBank breach notice, Oct 20); cause under investigation"
published: 2026-10-20
---

> TrustBank, operator of the Furusato Choice hometown-tax donation portal, says an Oct 17 intrusion exposed 4,454,097 member records including hashed passwords. It shut the service at 3:50 PM JST on Oct 19 and has no restart date.

[← Cybersecurity News](/news) · [markdown](/items/furusato-choice-trustbank-4-45m-breach.md)

confirmed (TrustBank breach notice, Oct 20); cause under investigation

2026-10-20

### Furusato Choice breach: TrustBank says an attacker took 4,454,097 donor accounts (names, addresses, phones, emails, hashed passwords, tax-deduction estimates) from Japan's hometown-tax portal; donations are suspended

TrustBank, which runs **Furusato Choice** (ふるさとチョイス), Japan's large furusato nozei (hometown tax donation) portal, said on Oct 20 that a third party accessed its member database and that donors' personal data was taken. According to the notice, staff noticed unusual access patterns on Mon Oct 19, then found that the unauthorized access had happened on **Sat Oct 17**. TrustBank stopped Furusato Choice and related services at **15:50 JST on Oct 19** (2:50 AM ET). Donations through Furusato Choice and its partner sites are suspended, and there is no restart date yet.

Confirmed so far: **4,454,097** member records containing name, email address, postal address, phone number, **hashed password** and the donor's estimated tax-deduction amount. TrustBank says the count and fields may change as the investigation goes on. It reported the incident to Japan's Personal Information Protection Commission on Oct 20 and plans to file a police report on Oct 21. The notice refers to a vulnerability it detected through the intrusion but doesn't describe it. Several prefectures and cities, including Shiga Prefecture and Saga City, have posted their own warnings to donors.

**Do now:** if you or your staff use Furusato Choice, change the password anywhere else the same email and password pair is used. The hashes may be cracked, and TrustBank itself asks for this. Expect well-targeted phishing: the attacker has real names, addresses and donation-related amounts, which makes fake "refund", "tax certificate" or "re-registration" emails, texts and letters convincing. Security teams in Japan may want to warn staff, since lures themed on hometown tax are easy to aim at anyone.

Sources: [TrustBank: notice of donor data leak (Oct 20, Japanese)](https://www.trustbank.co.jp/newsroom/newsrelease/news261020/) · [TrustBank: service suspension notice (Oct 19)](https://www.trustbank.co.jp/newsroom/news/news261019/) · [Shiga Prefecture press release](https://www.pref.shiga.lg.jp/bj00/press-release/34359.html) · [Saga City notice](https://www.city.saga.lg.jp/shisei/sagashioshiru/4/9053.html)