Trustbank confirmed on Tuesday that attackers exfiltrated 4,454,097 Furusato Choice member records, including a deduction figure TV Asahi says can partly reveal each donor's income, and Trustbank's own victim advice describes the exact damage one email per service would have absorbed. I run AliasFleet, an email-alias service: one forwarding address per site, so a leak names its source. A charity signup behaving like a bank statement.
What Trustbank confirmed
The disclosure came on 20 October from Trustbank and its parent Change Holdings, covered by Reuters, Impress Watch, TV Asahi/ANN and Nikkei.
Furusato Choice is Japan's big hometown-tax donation portal. About 1,700 municipalities, more than 760,000 thank-you gifts listed, per Asahi Shimbun. The sequence, from Impress Watch:
- 17 October: unauthorised third-party access.
- 19 October: Trustbank spotted the abnormal access, then confirmed the 17 October intrusion and the data exfiltration.
- 19 October, 15:50 JST: related services suspended to stop further damage. No restart date.
- 20 October: public disclosure, and a report filed with the Personal Information Protection Commission.
- 21 October: police victim report scheduled.
Six fields went out, per Impress Watch: names, email addresses, addresses, phone numbers, hashed passwords, and donation-deduction trial-calculation amounts. Trustbank has not said the 4,454,097 is a deduplicated count of people, so member records is the safe term. The company says the count and the contents may change as the investigation continues.
| Confirmed | Still open |
|---|---|
| 4,454,097 member records confirmed exfiltrated | Whether the number moves as the investigation continues |
| Names, emails, addresses, phone numbers in the file | Whether every record held all six fields |
| Passwords stored hashed, in unreadable form (Nikkei) | The hash algorithm; Trustbank has not named it |
| Trial deduction amounts per donor | How the attacker got in on 17 October |
| PPC report filed 20 October; police report due 21 October | Whether the dataset has surfaced publicly or been traded |
| No card data: the operator processes no payments | Any confirmed secondary misuse; none reported yet |
The deduction figure is the unusual part
Most breach files hold contact details and credentials. This one also holds each donor's 寄附控除試算額: the trial calculation of the largest donation that keeps the donor's own payment at 2,000 yen. TV Asahi/ANN reported the figure could let attackers partly work backwards to a member's annual income.
Look at the file from the attacker's side. Names and addresses already sort 4.45 million rows by location. Add a partly recoverable income estimate and the sorting gets a second axis: which households are worth a carefully written forged message, which ones are worth a phone call. A donor list becomes a priority list.
And here is the sharper point. Furusato Choice is not a financial service. It processes no payments and held no card numbers. Donors treated the signup the way people treat charity signups, not bank accounts. The file behaves like a bank statement anyway. That is what separates this breach from the usual names-and-emails spill: income-adjacent data, shipped by a site nobody would call financial.
What members were told to do
Trustbank's guidance to members, per Impress Watch:
- If you reused the same email and password combination on other services, change those passwords.
- Treat mail, SMS, calls and letters claiming to be Trustbank or its affiliates as suspect. Do not open links or attachments in suspicious mail, and do not enter personal information on suspicious sites.
- Send inquiries to the company by email.
The reuse advice is the tell. Passwords were hashed, not plaintext, so the credential risk here rides on passwords reused across sites, paired with the leaked email. If that mechanism is unfamiliar, how credential stuffing works explains it.
The impersonation warning is the second tell. The attacker holds the victim list, the names and the real context. A forged Trustbank notice quoting the breach back at you, asking you to click, confirm or re-enter details, should be treated as hostile until proven otherwise through a channel you typed yourself. How phishing uses your leaked email covers the pattern.
If Furusato Choice held your address, check it on Have I Been Pwned once the incident is listed, and turn on breach notifications. Then change every password you reused with that address, starting with your email account itself.
A real Trustbank notice and a forged one now look identical: same apology, same context, same request to act. The forged version just adds a link. Verify through Trustbank's own site, typed by you. No link in any email about this breach is worth clicking, including the real one.
One email per service contains exactly this
The email addresses in this file are the reusable identity. One email alias per service, a forwarding address used only for Furusato Choice, changes the impersonation math.
Every message landing on that alias is either from Trustbank or from the attacker. No third option. A breach notice on an address nobody but Trustbank ever had, quoting the real apology and asking for a password reset or personal details, has identified itself as the forgery. Kill the alias and the whole channel dies while the real inbox stays clean. That is the leak-tracing mechanism aimed at this exact attack, and the set-up guide takes about two minutes.
One thing the alias does not do: it does not stop the breach, and it does not hide the donor's name or the income-adjacent deduction figure. What it does is narrow the blast radius to the single channel the attacker was given.
What to do if your address was in the file
- Change the password on every service where you reused the Furusato Choice combination, starting with your email account. Credential stuffing pairs the leaked address with passwords from other breaches.
- Do not click links in any message about this breach. Open Trustbank's site by typing it, or use Furusato Choice's own channel. This applies to the genuine notice too: a habit that catches the forgeries has to catch the real ones.
- Expect forged notices that know your name and your donation history. Anyone quoting the breach back at you is proving they have the file, not that they are Trustbank.
- Check Have I Been Pwned once the incident is listed and switch on its breach notifications.
- Walk the breach-response order of operations. It is written for exactly this situation.
- For the next signup, use a unique alias per service, so the next leak names its source.
What the investigation still has to answer
Three things. First, whether the 4,454,097 figure moves as the investigation continues, and whether Trustbank clarifies the per-record field mix. Second, whether the dataset surfaces publicly or gets traded, which turns a confirmed exfiltration into a circulating one. Third, the entry vector: Trustbank says it is investigating with outside experts, but nothing has been said about how the attacker got in on 17 October.
Also watch the inbox angle. Trustbank warned members about forged notices, and its own inquiries run by email. If forged Trustbank messages start landing at scale, they will be the first real-world test of this file's targeting value. The file is out. The advice is out. Now it is a question of how far the file travels.
