Studio review: Security analysis after the cloud environment breach

Studio is a Japanese no-code website builder with more than 900,000 registered users that suffered unauthorized access to its cloud environment in late September 2026. Attackers exploited a vulnerability in certain features, making stored data externally retrievable for roughly two weeks until the company contained the issue. The service remains operational and continues to serve customers after rotating credentials and patching the flaw.

Timeline and technical details of the incident

Unauthorized access occurred between September 30 and October 1, 2026, Japan Standard Time. Studio discovered the activity internally on October 13, closed the access route the same day, and completed the fix on October 14. The company publicly disclosed the event on October 16 and issued further updates through late October. An unrelated maintenance window for PHP vulnerabilities followed on October 21–22.

Attackers accessed encrypted form submissions, API keys, webhook configurations, and proxy keys because the corresponding decryption keys were also exposed. Hashed passwords remained protected and no evidence of data tampering or deletion has appeared. Studio has stated it is proceeding on the assumption that data was obtained and has rotated its own encryption keys, including a full re-encryption step completed on October 17.

The service stores website content, CMS entries, forms, and connections to external tools such as Google Sheets and webhooks. Once the decryption key was read, any previously encrypted customer data and linked credentials became readable. No prior major security incidents had been widely reported for the platform before this event.

Scope of exposure and affected organizations

Every registered user falls within the potential impact range because the vulnerability allowed broad access to the cloud environment. Several organizations have already published specific counts of exposed records. The table below summarizes publicly reported figures from customer disclosures issued after October 16.

Additional companies and government entities, including Saitama Prefecture and Kyoto, reported smaller volumes ranging from hundreds to several thousand records each. Exact aggregate totals remain under review as Studio continues to refine its analysis. Downstream notifications to end users whose form data was stored on the platform began immediately after the initial disclosure.

Studio has advised all customers to change their Studio passwords, rotate any API keys, webhooks, or proxy keys that were stored on the platform, and delete then reissue live preview URLs. The company also offered joint reporting to Japan’s Personal Information Protection Commission. No secondary misuse incidents have been confirmed at the time of latest updates, though external forensics continue.

Current security posture and user actions

Studio now requires users to treat all previously stored credentials as potentially compromised. The company has implemented additional monitoring and plans further preventive controls, including re-encryption of older data sets. Customers continue to issue individual notices and monitor connected services for unusual activity.

Practical steps for existing users include reviewing every integration that received keys from Studio, revoking and regenerating those credentials at the destination service, and enabling any available logging on linked external accounts. Organizations that used the platform for public forms should confirm that affected individuals have been notified where required by local privacy rules.

Studio maintains an active user base that includes startups, municipalities, and national government agencies, indicating ongoing operational legitimacy despite the breach. The incident highlights the importance of isolating encryption keys from the environments they protect and of maintaining rapid detection capabilities for cloud workloads.