External leakage of personal information due to unauthorised access at a consolidated subsidiary
株式会社トラストバンク (consolidated subsidiary of the Company)
Member information for Furusato Choice and services related to that service
Unauthorised access by a third party. The cause of the detected vulnerability is under investigation.
Company response
Furusato Choice and related services were suspended from 15:50 on 19 October 2026. They will remain suspended until their safety can be confirmed.
Undecided. The Company will announce the date once it has been determined based on the status of the safety review.
A detailed investigation is under way with the cooperation of external experts.
Strengthening security measures, monitoring systems and information management systems
The Company's consolidated results for the fiscal year ending March 2027. The impact is currently under review.
The impact on the Company's consolidated results for the fiscal year ending March 2027 is currently under review. The Company will promptly disclose any matters requiring disclosure if they arise.
Related procedures
Report to the Personal Information Protection Commission, planned filing of a damage report with the relevant police station, and investigations and inquiries by the relevant authorities
Personal Information Protection Commission, police station with jurisdiction
The Company will proceed with a detailed investigation into the cause and scope of the impact, notification to affected individuals under the Act on the Protection of Personal Information, submission of a final report to the Personal Information Protection Commission, and cooperation with investigations and inquiries by the relevant authorities. The timing of service resumption will be determined after safety has been confirmed.
The Company will promptly announce the facts identified through the investigation, including the types and number of leaked information items and measures to prevent recurrence, once they have been finalised.
| Item | Details |
|---|---|
| Event name | External leakage of personal information due to unauthorised access at a consolidated subsidiary |
| Date of occurrence | Unauthorised access occurred on 17 October 2026 (Saturday). |
| Date recognized / date notice received | On 19 October 2026 (Monday), unusual access patterns were identified and the external leakage was confirmed. |
| Subject Entity | 株式会社トラストバンク (consolidated subsidiary of the Company) |
| Target Locations / Products | Member information for Furusato Choice and services related to that service |
| Cause | Unauthorised access by a third party. The cause of the detected vulnerability is under investigation. |
| Accounting period in which recognized | The Company's consolidated results for the fiscal year ending March 2027. The impact is currently under review. |
| Impact on Earnings Forecast | The impact on the Company's consolidated results for the fiscal year ending March 2027 is currently under review. The Company will promptly disclose any matters requiring disclosure if they arise. |
| Type of litigation or proceeding | Report to the Personal Information Protection Commission, planned filing of a damage report with the relevant police station, and investigations and inquiries by the relevant authorities |
| Court or authority | Personal Information Protection Commission, police station with jurisdiction |
| Date of filing / date of action | 20 October 2026 (report to the Personal Information Protection Commission completed); scheduled for 21 October 2026 (filing of a damage report with the relevant police station) |
| Suspended operations | Furusato Choice and related services were suspended from 15:50 on 19 October 2026. They will remain suspended until their safety can be confirmed. |
| Scheduled resumption date | Undecided. The Company will announce the date once it has been determined based on the status of the safety review. |
| Investigation structure | A detailed investigation is under way with the cooperation of external experts. |
| Measures to prevent recurrence | Strengthening security measures, monitoring systems and information management systems |
| Outlook | The Company will proceed with a detailed investigation into the cause and scope of the impact, notification to affected individuals under the Act on the Protection of Personal Information, submission of a final report to the Personal Information Protection Commission, and cooperation with investigations and inquiries by the relevant authorities. The timing of service resumption will be determined after safety has been confirmed. |
| Planned follow-up disclosure | The Company will promptly announce the facts identified through the investigation, including the types and number of leaked information items and measures to prevent recurrence, once they have been finalised. |
Items this document does not state (8)
These are items the company does not state in this document. We do not leave them blank, nor fill them in from other sources or by inference.
The reasons the company gives
The company's own explanation, not something inferred from the numbers.Unauthorised access by a third party. The cause of the detected vulnerability and the scope of its impact are under investigation.