On 20 October 2026, TrustBank, the operator of the furusato nozei (hometown tax donation) site Furusato Choice, announced that 4,454,097 member records had been leaked. The data covers names, email addresses, home addresses, phone numbers, hashed passwords and each member's estimated donation deduction. The site has been down since 19 October, with no restart date. This article covers what members should do now, what happens to receipts and one-stop applications for donations already made, and how to handle donations before the year ends. [TrustBank, 20 Oct 2026]
What happened: 4.45 million member records leaked, site suspended
According to TrustBank, the unauthorised access took place on 17 October. The company noticed it on the 19th and shut the service down.
| Date | Event |
|---|---|
| Sat 17 Oct | Unauthorised access to member data |
| Mon 19 Oct | Unusual access noticed and checked; related services suspended at 15:50 |
| Tue 20 Oct | Leak announced; reported to the Personal Information Protection Commission |
| Wed 21 Oct | Damage report to police (announced as planned); individual emails to members telling them whether and what was leaked |
| Fri 23 Oct | Second report: extra items (donation history, partial card details, etc.) leaked for 5 people |
The confirmed leaked data is below. TrustBank says the numbers and items may change as the investigation continues.
| Who | Items leaked |
|---|---|
| 4,454,097 members | Name, email, address, phone number, hashed password, estimated donation deduction |
| 5 of them (second report) | Point history (5), donation history (2), card last 4 digits, holder name and expiry (2), date of birth (2), delivery address (1) |
The card details were viewed on a My Page display screen and are not stored on TrustBank's systems. TrustBank says they cannot be used to make a card payment on their own. The 5 people have been contacted individually. [TrustBank second report, 23 Oct 2026]
What members should do now: reused passwords and fake messages
TrustBank asks members to do two things.
- If you use the same email and password on other services, change the password there. The passwords were hashed, but reused passwords can still lead to break-ins elsewhere.
- Watch out for emails, texts, calls and letters claiming to be from TrustBank or related parties. Don't open links or attachments in unexpected messages, and don't enter personal details or passwords.
Members have been receiving individual emails since 21 October. While genuine notices are going out, fake ones that copy them are harder to spot. Don't tap links in emails; check whether the same notice appears on TrustBank's official website. Kagoshima City notes that it will never ask for card or bank account numbers by phone or email. [Kagoshima City, 21 Oct 2026]
The estimated donation deduction is the cap you calculated on the site. Because the cap is worked out from income and family make-up, it can hint at your approximate income. Be especially careful with messages about money matters, such as "your deduction paperwork is incomplete" or "you have a refund due". We cover tax-refund scams in fake National Tax Agency emails.
Donations already made: receipts and one-stop applications go through the municipality
Even with the site down, the tax paperwork is between you and the municipality you donated to. According to the Ministry of Internal Affairs and Communications, the receipt used for a tax return is issued by that municipality, and the one-stop exception application is sent to it as well. Portal sites only handle the order and payment. [MIC: how furusato nozei works]
| Item | Handled by | What to watch now |
|---|---|---|
| Receipt (attached to a tax return) | Municipality you donated to | If it hasn't arrived, or you're unsure the payment went through, ask the municipality |
| One-stop exception application | Municipality you donated to | Due by 10 January of the following year. For employees and others who don't file a return and gave to 5 or fewer municipalities |
| Annual "certificate of donation deduction" | Furusato Choice (NTA-designated operator) | No announcement on issuing it during the outage. Municipal receipts can be used instead |
| Tax return | Tax office | Due by 15 March of the following year. Filing a return cancels all one-stop applications |
Furusato Choice is one of the "designated operators" approved by the Commissioner of the National Tax Agency, which can issue a single certificate covering a year of donations. But the standard attachment for a tax return is the receipt for each donation; the annual certificate is something you "may use instead". [NTA: certificates of donation deduction] Keep the receipts municipalities send you.
The one-stop deadline is 10 January of the year after the donation (the next business day if it falls on a weekend or holiday). Not filing a tax return is a condition, so if you file one after sending the application, the one-stop exception no longer applies. [Minato City one-stop guide] If you file for medical expenses or other reasons, include your furusato nozei donations in the return (filing a return cancels one-stop).
While the site is down, you can't see your donation history on My Page. Use the donation confirmation emails and your card statement to list the municipalities, dates and amounts. That lets you check that all receipts have arrived and that you are within 5 municipalities.
Donating before the year ends: 10 sites are paused, including partner sites
Partner sites that share Furusato Choice's system have also stopped taking donations. As of 21 October, Kagoshima City listed these 10 sites. [Kagoshima City, 21 Oct 2026]
- Furusato Choice
- au PAY Furusato Nozei, Saison no Furusato Nozei, KABU& Furusato Nozei, V Furusato Nozei, Marui Furusato Nozei
- Carenet Furusato Nozei, Furusato Nozei Department, Nifty Furusato Nozei, YAMAP Furusato Nozei
Check each partner site's own notice to see whether its members' data is part of the leak.
To count towards this year's deduction, a donation must be made by 31 December. Without waiting for the site to restart, you can donate through the municipality's official website (some run their own donation pages) or through another portal. Kagoshima City also points donors to its own special site and other portals.
Two things to watch when switching sites:
- The deduction cap is a yearly total, not per site. Add what you gave on Furusato Choice to what you give elsewhere and keep the total under the cap. You can check a rough cap by income and family in our furusato nozei guide for employees
- The "5 municipalities" limit for one-stop is also a total. If your donations across all sites go to 6 or more municipalities, you need to file a tax return. Several donations to the same municipality count as one (Minato City guide)
Summary
- 4,454,097 Furusato Choice member records leaked: name, address, phone, email, hashed password and estimated donation deduction
- Change passwords you reused elsewhere, and don't open links in messages claiming to be from TrustBank or a municipality
- Receipts and one-stop applications are handled by the municipality you donated to. Applications are due by 10 January of the following year
- 10 sites, including partner sites, are paused. If you donate another way this year, count the cap and the 5-municipality limit across all sites
Related articles
Editors' picks
Popular articles
References (sources)
- TrustBank, apology and notice on the leak of donor information due to unauthorised access (20 Oct 2026, Japanese)
- TrustBank, second report (23 Oct 2026, Japanese)
- Kagoshima City notice on the Furusato Choice leak (21 Oct 2026, Japanese)
- Niigata Prefecture notice (21 Oct 2026, Japanese)
- Chuo City notice (21 Oct 2026, Japanese)
- MIC furusato nozei portal: how it works (Japanese)
- MIC furusato nozei portal: tax deductions (Japanese)
- NTA: certificates of donation deduction for furusato nozei and list of designated operators (as of 16 Jun 2026) (Japanese)
- Minato City guide to the one-stop exception (Japanese)
Information as of 25 October 2026. The number and items leaked, the restart date and the handling of donations and certificates may change with further announcements from TrustBank. Ask the municipality you donated to about your donation status and receipts.