Trustbank, the CHANGE Holdings subsidiary that runs Furusato Choice, will reopen web donations at 12:00 on November 6, 2026. CHANGE Holdings said in the fifth report on the breach that the web version passed the necessary safety measures and verification, carried out with external experts and specialist organisations.
What is still shut
The web reopening is partial. The Furusato Choice app and Choice Pay will return "after preparations are complete", with no date given. CHANGE Holdings said it plans a final report on the unauthorised access for investors later.
The web restart follows two earlier steps, according to the notice. The donation management system, which municipalities and gift suppliers use to confirm donations and arrange shipping, resumed on October 26. Integration systems for services that complete the donation application and payment on partner sites resumed on October 28. The notice does not say when the app or Choice Pay will return. For an earlier account of the partner-site link, see Earlier Tokyo Brief coverage.
Scope of the breach
The notice puts the number of records with confirmed external leakage at 4,454,097, covering Furusato Choice and related services. The member data involved is names, email addresses, addresses, phone numbers, hashed passwords and estimated donation-deduction amounts. The notice counts records, and does not say they are unique individuals.
Five donors, who are among those 4,454,097 records, had more exposed or altered. Their cases overlap, so the five is the total, not a sum of the categories:
| Item | Donors affected |
|---|---|
| Point history | 5 |
| Donation history | 2 |
| Card details (last four digits, name, expiry) | 2 |
| Date of birth | 2 |
| Delivery address | 1 |
| Partial deletion of address (prefecture) | 1 |
The notice says the card details (last four digits, name, expiry) are not stored in Trustbank's systems. They are fetched from the payment processor each time a member opens the saved-card page, and a third party was confirmed to have accessed that page for the two members. It adds that this information alone cannot be used to make a card payment.
Notifications and cost
Trustbank has been emailing registered members individually since October 21 to say whether their data leaked and which items were affected, and has contacted the five donors directly.
The effect on CHANGE Holdings' consolidated results for the year to March 2027 is still under review. The company said it will disclose promptly anything that must be reported, and any new facts from the continuing investigation once confirmed.