Trustbank, the CHANGE Holdings subsidiary that runs the Furusato Choice donation site, restarted one part of the platform on 26 October: the donation management system. Donations themselves cannot resume. CHANGE Holdings said the restart is "a first step" toward full recovery and does not make new donations possible, according to its third report on the breach.
What restarted
The donation management system is the back-office tool that municipalities and suppliers of return gifts use to confirm donations received and arrange shipments. Trustbank said it ran safety measures and verification with outside experts and institutions before concluding the system was safe to bring back.
All other services remain suspended. Trustbank said it is still carrying out safety measures and verification on them with outside specialists, and will post restart decisions on the CHANGE Holdings and Trustbank websites. CHANGE Holdings said it will report the staged recovery to investors as it proceeds.
What was taken
The disclosure puts the leak at 4,454,097 records, covering Furusato Choice and related services. The member data involved comprises names, email addresses, addresses, phone numbers, hashed passwords and estimated donation-deduction amounts. The notice counts records and does not say how many individual people they represent.
Five donors, who are included in the 4,454,097, had more exposed. All five had point histories leaked. Two had donation histories exposed, two had card details (last four digits, name and expiry date) exposed, and two had birth dates exposed. One had a delivery address exposed, and one had part of an address (the prefecture) deleted. The categories overlap, so the total is five donors, and the notice does not say which donors fall into which categories. Earlier Tokyo Brief coverage
The card details are not stored in Trustbank's systems. The saved-card information page within My Page fetches them from the payment processor each time that page is accessed, and a third party was confirmed to have accessed that page for the two members. The notice adds that this information alone cannot be used to make a card payment.
What is still open
Trustbank began emailing registered members individually from 21 October to say whether their data leaked and which items, and has contacted the five donors directly.
CHANGE Holdings said the effect on consolidated results for the year ending March 2027 is still under review and that it will disclose anything material promptly. The notice gives no financial estimate and no timetable for reopening donations. Trustbank's investigation with outside experts continues, and CHANGE Holdings said it will report new facts once confirmed.