Studio says site data may have been readable from outside

Studio, the website builder, says a third party used a flaw in part of its product and left data in its cloud readable from outside. Its notice says the access it has confirmed ran from September 30 to October 1, Japan time, and that the data stayed obtainable until Studio closed the path on October 14. Studio says it has not confirmed that anyone actually took a copy. It is handling the incident as if they did.

The flaw is fixed, Studio says, and it has not confirmed that the access is still going on. It has not set a date for the outside firm's write-up of the cause.

What may have left

Studio says this applies to every registered customer, not to a counted subset. The counts by feature are still being checked. On October 16 it emailed project owners by feature. A missing email is not proof you were left out. Studio tells people to check spam and then its contact form.

The notice lists:

• The Studio account: username, email address, and the password stored as a hash, not as the password you typed.
• What you keep in Studio: the design editor, CMS content, form submissions, Google reCAPTCHA v3 settings, and webhook URLs.
• Live-preview URLs for pages that are not public yet.
• Secrets in settings: API keys and tokens for connected services, passwords on password-protected pages, Google Sheets connection credentials, and custom-proxy keys.

Form submissions and those secrets were encrypted. Studio says the key needed to read them was read in the same access, so encryption does not, by itself, mean the contents stayed hidden.

Studio has not confirmed that customer designs or CMS entries were rewritten or deleted. The credentials that were taken included permission to write. Studio says it has disabled those credentials, and that its own logs show no rewrite or delete of that content. An outside firm is still checking the data.

What Studio already changed

On October 14, around 2:30 a.m. Japan time, Studio signed every logged-in customer out. The next visit asks you to sign in again.

It has rotated the credentials it used for customer data, including payment and sign-in credentials. On October 17 it rotated the key that encrypts form submissions and external API keys. New saves use the new key. The old key remains only so Studio can read data saved before the rotation, and Studio says it is re-encrypting that data so the old key can be retired.

That rotation does not claw back a copy that already left. API keys and tokens that belong to another service are issued by that service. Studio cannot revoke them. It says it has already issued new custom-proxy keys.

Google Sheets is a narrower case. Studio says it updated the connection key on October 14, and that the credentials which may have been copied can no longer be used. Answers can still land in the sheet. It still recommends disconnecting the link, removing Studio's access on the Google account's linked-apps page, and connecting again if you want answers in a sheet. The new connection creates a new sheet. While the link is down, answers are not added to the sheet. If saving results in Studio is on, they stay in the Studio dashboard. If it is off, they go only to the notification address, so check that address first. Removing Studio's access stops sheet updates for every project on that same Google account.

A form embedded from somewhere else, such as Google Forms, sends the answer from the visitor's browser to that other service. Studio says those answers were not stored by Studio. The embed code itself sits in the design editor, so a key pasted into that code is in the set that may have been read.

Answers sent while "save form results in Studio" was off were not stored there. Answers already in the dashboard stay in scope until they are fully deleted, even if saving was turned off later. Notification emails of answers are not stored by Studio.

A government site that used Studio

Japan's Digital Agency said on October 22 that it used Studio for part of its website, and that it learned of the access on October 16. Its English notice is still checking scope. It lists inquiry forms submitted from May 2021 through March 2023, and it gives a ceiling for each form, not one total of people:

• General comments and requests: up to 8,833. Name, email, and the message. Name and email were optional.
• Hiring: up to 250. Name, email, phone, and the message.
• Vaccination-certificate app: up to 3,661. Name, email, and the message.
• Myna-chan costume rental: up to 117. Name, email, affiliation, delivery address, phone, and related fields.
• Workshops and other participation: up to 462. Name, email, affiliation, phone, and related fields.

It also lists 35 Studio accounts belonging to agency staff or contractors: name and email. It says it has not confirmed misuse. It says it will not ask for a password or a card number by email or phone.

What to do

1. Change the Studio password if you have one. Studio stores a hash, not the password itself, and says recovering the password from the hash is difficult. It also says it cannot rule that out, so it is asking for a change. If you used that same password anywhere else, change it there too. An account that only signs in with Google or Facebook, and never had a Studio password, does not need this step. If you once registered with an email and password, reset it from the "forgot password" link. Studio's own mail about this incident does not include a link that asks you to type a password or a credential.
2. Rotate keys that Studio cannot revoke. That is the external API key or token in Data Connect API or API integration (Beta), and the password on a password-protected page. Update the new value inside Studio after you rotate it at the source. Custom-proxy keys are the exception Studio says it already reissued.
3. Read the October 16 mail before you assume you are done. The subject starts with the Japanese importance marker and names the project. It is how Studio tells you which of your projects used forms, API connections, a page password, or a custom proxy.
4. If you only filled in a form on someone else's Studio site, wait for that site. Studio's password reset is for Studio accounts. A person who submitted a form is in the form-answer set, which the site owner holds. The Digital Agency's advice for its own forms is to ignore unexpected links and attachments, and not to enter a password or a card number into a message.

Sources

• Studio, Notice of unauthorized access, October 16, 2026
• Digital Agency, About the possibility of personal information leakage due to unauthorized access at Studio Co., Ltd., October 22, 2026