CHANGE Holdings said its subsidiary Trust Bank would restart donation intake on the Furusato Choice app at 15:00 on November 9, which leaves one service still switched off after the data breach: Choice Pay. The company's sixth report on the incident says Choice Pay is planned to restart after preparations are complete, without giving a date.
What is back, and when
Trust Bank has staged the restart service by service, according to the sixth report. The donation management system, the back-office tool municipalities and gift suppliers use to check donations and arrange shipping, resumed on October 26. The linked system for services that run from donation application through payment on partner sites resumed on October 28. Web donations restarted at 12:00 on November 6.
The app is the last of the main donation channels to come back. CHANGE Holdings said Trust Bank confirmed it was safe to reopen after carrying out safety measures and verifying them with outside specialists. With the app restart, donations will be available on both the web and app versions. The notice uses the present-tense phrase "will restart", so the 15:00 reopening is reported as scheduled in a notice dated the same day, not as a confirmed completion. For the earlier web reopening, see Earlier Tokyo Brief coverage.
What was taken
The notice puts the confirmed leak at 4,454,097 records of Furusato Choice member information. The fields are name, email address, address, phone number, hashed password and estimated donation-deduction amount.
A far smaller group was hit harder. Five donors, who are included in the 4,454,097, also had further information leaked or altered. The five had point history affected. Two had donation history affected, two had birth date affected and two had partial card data affected; one had a delivery address affected; and one had part of an address (the prefecture) deleted. The notice says the categories overlap and the five donors are the total.
The card data is the last four digits, cardholder name and expiry date. Trust Bank says it does not store these: the saved-card page on a member's account retrieves them from the payment processor each time it is opened. A third party accessed that page for the two members, the notice says, and the information alone cannot be used to make a card payment.
Trust Bank began emailing members individually from October 21 on whether their data leaked and which items, and has contacted the five donors directly.
What remains open
Trust Bank is continuing a detailed investigation with outside specialists and is strengthening system monitoring and ongoing system checks. CHANGE Holdings said any new facts will be disclosed once confirmed. It said Choice Pay is planned to restart after preparations are complete, and that a final report to investors on the incident is planned for a later date.
The effect on CHANGE Holdings' consolidated results for the year to March 2027 is still under review, and the notice gives no estimate.