Trust Bank, the CHANGE Holdings subsidiary that runs Furusato Choice, said it is restarting from October 28 the system that links the platform to partner sites, according to the group's fourth report on the unauthorized-access incident. The restart is partial. Donations at partner sites will not all resume at once.
What is back
The system being restarted covers services in which a donation, from application through payment, is completed inside a partner's own site. Trust Bank says it carried out the necessary safety measures and verification with outside specialists and confirmed it was safe to resume. CHANGE Holdings states that no leak of personal information has been confirmed for donations made through those partner sites.
Each partner will reopen donation intake in turn, depending on its own operation checks and data-link checks.
The donation management system, the back-office tool that municipalities and gift suppliers use to confirm donations and arrange shipments, was already restored on October 26. See the Earlier Tokyo Brief coverage.
What stays shut
Other Furusato Choice services, including the donor-facing site, remain suspended. Trust Bank is carrying out safety measures and verification on them with outside specialists. CHANGE Holdings says it will announce a restart on its own and Trust Bank's websites and report it to investors once one is decided.
Confirmed breach scope
The confirmed leak covers 4,454,097 records. For those records, the member information involved is names, email addresses, addresses, phone numbers, hashed passwords and estimated tax-deduction amounts.
Five of those donors had more exposed or affected data: all five had point histories involved. Two had donation histories, two had birth dates, and one had a delivery address involved. One had part of an address (the prefecture) deleted. The company says the categories overlap and that the five are included in the 4,454,097 total. The more sensitive items therefore apply to five people, not to the full set.
For two members, a third party accessed the saved-card display page in My Page, which showed the last four digits of the card number, the name and the expiry date. The company says this information is fetched from the payment service provider each time the page is opened and is not stored in Trust Bank's systems, and that it cannot by itself be used to make a card payment.
Trust Bank began emailing registered members individually from October 21 about whether their data leaked and which items were affected, and has contacted the five donors separately.
Financial impact
CHANGE Holdings says the effect on its consolidated results for the year ending March 2027 is still being examined, and that it will disclose promptly any matter that requires it. The company also says it will report promptly any new facts the investigation establishes.