Studio Co., Ltd.: Vendor Cloud Breach Exposes Japan Digital Agency Inquiry Data

Japan's Digital Agency said on October 22, 2026 that personal information sent through its website may have leaked. The cause was unauthorized access at Studio Co., Ltd., the no-code website platform that runs the sites of the agency and its Preparatory Office for Digital Reform-related Bills. Studio's own notices say an unidentified third party exploited a vulnerability in one of its features between September 30 and October 1, 2026, which left data in its cloud environment retrievable from outside until October 14. Studio has not confirmed that anything was actually taken, but it is treating the data as taken. The attacker also read the key used to decrypt stored form submissions and API keys. For the Digital Agency alone, the possibly affected inquiry messages listed so far add up to more than 12,800. Studio's customers are disclosing their own figures one by one, from a few thousand to more than 21,000 form submissions each.

What Happened

The dates below come from Studio's English first notice (October 16) and its Japanese incident portal (last updated October 20):

• September 30 to October 1, 2026 (JST): A third party exploits a vulnerability in "some functions" of Studio and gets into its cloud environment. Studio says this is the access period confirmed so far.
• October 13: Studio's internal investigation confirms the intrusion.
• October 13 to 14: Studio patches the vulnerability and closes the access route. Data stops being retrievable from outside.
• October 16: Studio publishes its first notice and starts telling customers.
• October 17: Studio rotates the encryption key that protects form submissions and third-party API keys.
• October 18 to 20: Studio opens its incident FAQ portal and adds guidance on reporting to Japan's Personal Information Protection Commission (PPC).
• October 22: The Digital Agency publishes its notice.

The company's name varies across documents. The Digital Agency's notice says both "Studio Co., Ltd." and "Studio K.K.", and enechain says "Studio Inc." All of these refer to the same company, Studio株式会社, which runs Studio.Design.

Studio says it has found no ongoing access, and no tampering with or deletion of data. It confirms that the credentials the attacker obtained had write permissions. Studio says it has revoked them, and that its logs show no changes to customers' design editor or CMS content. An outside forensic firm is still checking. Studio is also still investigating whether any secondary harm has occurred, such as fraudulent logins or misuse of data.

What Was Taken

Digital Agency. The notice covers its website inquiry forms from May 2021 to March 2023, and the agency says the scope is still being reviewed. Categories listed so far:

• General comments and requests: up to 8,833 messages (name, email, inquiry content)
• Employment inquiries: up to 250 messages (name, email, phone, inquiry content)
• Vaccination certificate app inquiries: up to 3,661 messages (name, email, inquiry content)
• Myna-chan mascot costume rental requests: up to 117 messages (name, email, affiliation, delivery address, phone)
• Workshop and other event participation forms: listed, but no count was available in the material reviewed

The agency notes that names and email addresses were optional on these forms, so some messages contain no personal data.

Studio platform-wide. According to Lemma and Japan Cyber Watch, which both cite Studio, the possibly exposed data includes:

• account data for all registered users, with passwords stored as hashes
• form submissions from customer websites
• API keys and tokens for connected services such as headless CMSs
• Google Sheets connection credentials
• proxy keys and webhook URLs

Most of this was encrypted, but the decryption key was read in the same intrusion. JIJ Inc. says Studio told it that attachment file names were exposed but the contents of the files were not.

Downstream customer counts, by source:

Relic's 8,538 includes repeat submissions from the same person and posts with no personal data. It covers 19 services and may grow. Japan Cyber Watch also reports smaller exposures at Saitama Prefecture and the City of Kyoto through their contractors. ITmedia, as cited by Japan Cyber Watch, puts Studio's user base at more than 900,000. Studio has not published a total record count and says one will come in a follow-up.

Why It Matters

• This is a supply-chain exposure of a national government body. The Digital Agency runs Japan's digitalization agenda, including My Number. Its weak point here was a marketing-site builder, not its own systems. Agencies and prefectures inherited the risk through website contractors that may not appear on any vendor risk register.
• The encryption did not protect the data. Stored data was encrypted, but the key was readable from the same environment, so the encryption gave almost no protection. Lemma's analysis makes this its central point.
• The breach went unnoticed for almost two weeks. Studio confirmed the intrusion 12 to 13 days after it happened. Its customers have no logs of their own to check what was read.
• The stolen keys can open other systems. API tokens, Sheets credentials and webhook URLs let an attacker reach customers' other services, not just read inquiry text. Any token issued before October 14 and not yet rotated should be treated as compromised.
• Japan's regulator changed its process for this case. According to Japan Cyber Watch and JIJ, the PPC first asked affected customers to hold their individual breach reports. On October 20 it allowed them to join a single report filed by Studio without being treated as late. Telling affected individuals is still each customer's own duty.
• Phishing follow-ups are likely. The data ties names and emails to specific government services, including the vaccination certificate app and job applications. That makes convincing fake "Digital Agency" emails easy to write. Relic has already warned its customers about scam emails and calls that piggyback on the incident.

The Attack Technique

Studio has not named the vulnerability or published root-cause findings, and has said these will follow once confirmed. What the primary notices do establish:

• The way in was a vulnerability in a Studio product feature, not stolen customer credentials.
• From there, the attacker obtained cloud credentials with read and write access and set things up so that data inside Studio's environment could be retrieved from outside.
• The attacker also read the encryption key that protected form contents and third-party API keys.
• No threat actor has been named, and no ransom demand or leak-site listing appears in any of the sources.

Studio's response to customers points to which features were exposed. It sent targeted instructions to anyone using API integrations, password-protected pages, forms or custom proxy. It also rotated payment and login credentials, and replaced its encryption key on October 17. Japan Cyber Watch reports that on October 21 Studio began suspending its dashboard and editor. The source text available for this brief is truncated, so the details of that suspension are unconfirmed here.

What Organizations Should Do

1. List your no-code and website-builder vendors. Find every site built on Studio, or any similar SaaS, that collects form data. That includes sites run by agencies and contractors. Relic is still discovering affected sites of its own.
2. Rotate every secret stored in the platform. Revoke and reissue API keys, CMS tokens, Google Sheets OAuth grants, proxy keys and webhook URLs created before October 14. Then check the logs of those downstream services from September 30 onward.
3. Reset passwords, and use SSO or MFA. Staff who log into Studio with a password should change it, as JIJ instructed its employees to do. Where the platform supports it, move to SSO or MFA.
4. Don't keep form data in the vendor's platform longer than needed. Send submissions straight to your own systems, and delete what is stored at the vendor on a schedule. The Digital Agency's exposed data goes back to 2021.
5. Prepare for regulator reporting and notification. If you are a Japanese entity, decide whether to report to the PPC yourself or join Studio's joint filing. Either way, you are still responsible for telling the people affected.
6. Warn your users about phishing. Tell them you will not ask for passwords or personal details by email or phone, and watch for lookalike emails that use your brand.

Sources: About the possibility of personal information leakage due to unauth... | 不正アクセスに関するご案内｜Studio | Notice Regarding Unauthorized Access to Web Creation Service "Studi... | 【重要】ノーコードWebサイトプラットフォーム「Studio」への不正アクセスに伴う、情報流出の可能性に関するお詫びとお知らせ 株式... | Studio Breach in Japan: A No-Code Website Builder Exposes Its Custo... | Important Notice of Possible Exposure of Inquiry Form Information F... | Studio: A no-code website-builder SaaS's cloud environment was brea... | Important Initial notice of unauthorized access and data exposure...