Furusato Choice, Furusato Nozei Site, Leaks 4.45 Million Member Records Including Donation Tax Deduction Estimates

What happened

Trust Bank said that an outside party got into the Furusato Choice system without permission on October 17. Member names, addresses, email addresses, phone numbers, hashed passwords, and tax deduction estimates were leaked. On October 19, the company saw unusual access patterns and shut down related services at 3:50 p.m. It has not said when the service will reopen.

Key numbers and facts

• About 4,454,097 pieces of personal data were leaked.
• The hack happened on October 17, and was found on October 19.
• The site has a tool that estimates a person's donation limit using income and family details. These results were saved in members' My Page areas.
• The company reported the leak to Japan's Personal Information Protection Commission on October 20.
• The company plans to report the crime to police on October 21.

Background: what is Furusato Choice?

Furusato nozei (hometown tax) lets people in Japan donate money to a town they choose. In return, they get a tax cut and often a thank-you gift, such as local food. Furusato Choice is one of the main websites where people find towns and make these donations. Because it stores tax details, the leak of estimate results is especially sensitive.

Why it matters

Millions of people may have their personal details exposed. Criminals can use leaked emails and passwords to try to log in to other services. The company asks members who use the same email and password on other sites to change those passwords right away. The numbers may still change as the investigation goes on.

What to watch

• When Furusato Choice will restart, which depends on safety checks.
• Whether the leaked number or the list of leaked data changes after more investigation.
• Results of the police report and the privacy regulator's review.
• Whether members get warnings about phishing or other scams using their information.