CHANGE Holdings has told investors that the unauthorised access at its subsidiary Trustbank exposed more for five donors than first reported. The total number of affected records has not moved.
What was added
The first report, dated 20 October 2026, covered 4,454,097 member records on Furusato Choice, the donation platform Trustbank runs. The data items were names, email addresses, addresses, phone numbers, hashed passwords and estimated donation-deduction amounts.
In the second report, dated 23 October 2026, CHANGE Holdings says further investigation found extra items exposed for five donors, all already inside the original count. Point history was exposed for all five. Donation history and date of birth were each exposed for two, and a delivery address for one. One of the five also had part of the registered address, the prefecture name, deleted. The groups overlap, so the five are not separate cases.
The card details
For two members, third-party access was confirmed to the saved-card display page on their account. That page shows the last four digits, the name and the expiry date.
CHANGE Holdings says Trustbank does not store those details. The page pulls them from the payment processor each time it is opened, and the information alone cannot be used to make a card payment.
Response and cost
Trustbank has contacted the five donors individually. It began emailing Furusato Choice members on 21 October 2026 to say whether their data was affected and which items. The investigation continues with outside specialists, and CHANGE Holdings says it will disclose new findings once confirmed.
The company says the effect on consolidated results for the year ending March 2027 is still being examined. The notice gives no figure for the cost.