Trustbank's Furusato Choice breach (4,454,097 member records): names, addresses and hashed passwords leaked — what donors should do

The leaked items include hashed passwords. Hashing transforms a password so it is not stored as-is. Short or guessable passwords, however, can in general be recovered with enough time (see What is password hashing?).

The company asks anyone who uses the same email and password combination as on Furusato Choice on other services to change the password on those services. Start with services tied to money or personal data, such as online shopping, points programs and email, and turn on two-step verification wherever you can (Which 2FA method is safest?).

With name, address, phone number and email address together, someone can write a convincing fake message that greets you by name. Donors would not be surprised to hear about return-gift deliveries or donation paperwork, which makes fake messages on those topics harder to spot.

The company asks people to watch for suspicious emails, text messages, phone calls and letters impersonating it or related parties, and not to open unfamiliar URLs or attachments. To check anything, use the official site or the municipality's official page that you open yourself (see What is phishing?).

The company asks people not to enter personal data or passwords on suspicious websites. Nothing in the notices says users will be asked for card numbers, bank details or passwords because of this incident.

If a call or letter asks for such details in the name of an apology, a refund or re-sending a return gift, do not respond; hang up and check through the official contact.

The company says it has been emailing members individually, in sequence since October 21, about whether their personal data leaked and which items were confirmed.

Genuine notices and fakes imitating them can arrive at the same time. If you get one, do not log in or take action through its links; compare it with the notices on Trustbank's newsroom. The contact listed in the notices is an email address (toiawase@trustbank.co.jp).

As of October 25, the company's notices say nothing about effects on one-stop exception applications, tax returns or donation receipts. Services have been suspended since October 19, and donations through Furusato Choice are not being accepted (according to municipalities such as Izumiotsu City). Check the company's and your recipient municipality's official pages for guidance.

According to the company, saved card details were fetched from the payment processor each time the My Page screen was shown and were not stored in its systems. Only the last four digits, cardholder name and expiry date were displayed. On a membership site that handles cards, a setup where you do not hold card numbers yourself (using the payment processor's storage) limits the damage if an intrusion cannot be stopped.

The leaked passwords were hashed. How strong the hashing was (whether salted, whether a slow algorithm) has not been published. In general, a salted, slow algorithm (bcrypt, scrypt, Argon2 and similar) greatly increases the time needed to recover the original passwords (How to store passwords safely). In its first report, the company asked users to change passwords they had reused elsewhere.

The company noticed unusual access patterns, checked them and shut the service down on October 19, two days after the unauthorized access. Tracking the daily volume and frequency of access to member records, with an alert when the volume departs from normal, and deciding in advance who makes the call to shut the service down, shortens the time from noticing to stopping.

The leaked items included the estimated tax deduction amount. In general, deciding whether and how long you need to keep calculated results and histories stored for users' convenience, and not keeping those you do not need, reduces what can leak (how the company stored this item has not been published).