Furusato Choice Data Breach: 4.45m Records at Risk

Japan’s biggest hometown tax-donation season is approaching, and one of the main portals for it has gone dark.

Trustbank, which runs the Furusato Choice platform, said on 20 October that unauthorised access to its systems may have exposed 4,454,097 member records. The exposed data includes names, email addresses, postal addresses, phone numbers and hashed passwords. It also includes each member’s estimated donation deduction. The breach is the latest on our Ransomware & Cyber Attacks hub, following recent incidents at Hankyu Hanshin and Arcadia.

The breach began on a Saturday and wasn’t noticed until Monday

According to Trustbank’s statement, staff noticed unusual access on Monday 19 October. The company then confirmed that unauthorised access had taken place on Saturday 17 October. It stopped Furusato Choice-related services at 15:50 Japan time on 19 October (07:50 BST). External experts have since found a vulnerability, though Trustbank hasn’t described it. It also says the number of affected records may change as the investigation goes on.

Trustbank reported the incident to Japan’s Personal Information Protection Commission on 20 October and said it planned to go to the police on 21 October. It hasn’t said when services will resume.

Furusato nozei, or hometown tax donation, lets residents give money to a local authority of their choice. In return they get a tax deduction and, usually, a gift from the area. Portals such as Furusato Choice handle the donations for municipalities. ITmedia explains where the deduction figure comes from: the site has a tool that estimates how much a user can give before hitting their deduction cap. Users enter their annual income and family make-up, and can save the result in their My Page area. Those saved estimates were among the exposed data, so in some cases the breach may reveal approximate income as well as contact details.

Councils are losing a donation channel

The shutdown reaches beyond members. Kagawa Prefecture, which accepts donations through Furusato Choice, says it was notified on 20 October and that donations through the portal can’t be made while the service is suspended. Many people make their donations in the last months of the calendar year, so for councils that rely on the platform, the timing of an open-ended outage is awkward.

Trustbank is asking members to change their password on any other service where they used the same one. Although the stored passwords were hashed, the company is treating reuse as a risk. It also warns users to watch for fake emails, text messages, phone calls and letters claiming to come from Furusato Choice. A leak that pairs names and addresses with tax-related figures gives scammers a convincing pretext. Expect those messages to talk about refunds and deductions.