Studio review: Form Data and API Key Exposure Risks After 2026 Breach
In short
Studio suffered unauthorized access between late September and mid-October 2026 that potentially exposed form data and third-party credentials for its more than 900,000 registered users.
Studio, the Japanese no-code website builder, confirmed unauthorized access to its cloud environment between September 30 and October 1, 2026. The exposure lasted until October 13-14, when the company closed the vulnerability. All registered users face potential risks to stored form responses and integration credentials.
The incident affects account details, site content, form submissions, and API tokens. Studio has not confirmed actual data exfiltration but treats it as possible. Public notices and customer disclosures provide the main details available as of late October 2026.
Timeline and Scope of the Studio Breach
Attackers accessed Studio's cloud environment by exploiting a vulnerability in certain features. Data stayed externally reachable for nearly two weeks until the company identified the issue on October 13 and issued a public notice on October 16. External specialists continue forensic work, and Studio reported the event to Japan's Personal Information Protection Commission.
The breach potentially touched every registered account. Earlier user figures stood near 500,000, while current estimates exceed 900,000. Impacted items include usernames, emails, hashed passwords, Design Editor and CMS content, stored form submissions, live preview URLs, and various credentials. Many third-party API keys and tokens were stored in plaintext or with keys that were also accessed.
Nearly 100 organizations have already disclosed possible exposure. Examples include Japan's Digital Agency with up to 13,323 form submissions, Luup with roughly 21,000 entries, Raksul with about 6,400, and Link-U Group with around 7,700. Most affected sites used Studio forms for contact and inquiry collection.
Exposed Data Types and Associated Risks
Form submission contents stored inside Studio formed the largest category of exposed material. This includes responses still marked as active or moved to Trash, plus file names of attachments. Responses fully deleted before September 30 and forms embedded from external services were not included.
Credentials for third-party services represented another major risk category. Exposed items covered API keys and tokens for headless CMS platforms such as Notion and microCMS, Google Sheets sync settings, webhook URLs, custom proxy keys, passwords for protected pages, and reCAPTCHA v3 configuration values. Although some items were encrypted, the decryption key was also obtained during the incident.
| Data Category | Examples | Potential Impact |
|---|---|---|
| Form Submissions | Inquiry responses, file names | Privacy exposure, phishing targets |
| API Credentials | Notion tokens, Google Sheets keys | Third-party service compromise |
| Account Data | Emails, hashed passwords | Account takeover attempts |
| Page Settings | Protected page passwords | Unauthorized content access |
Studio replaced its own encryption key on October 17 and reset internal credentials. The company urges users to take specific remediation steps and continues to investigate root cause and any secondary harm. No confirmed misuse has been reported so far.
Recommended User Actions After the Studio Incident
Studio advises every account holder to change the Studio password unless they rely solely on Google or Facebook login. Users should also delete and recreate live preview URLs. These basic steps reduce immediate account risks.
Additional actions apply to users of specific features:
- Rotate third-party API keys by creating new tokens first, then revoking the old ones.
- Change any passwords set for protected pages.
- Update webhook URLs and reconfigure Google Sheets integrations.
- Review custom proxy settings and replace keys where necessary.
- Monitor inboxes and logs for unusual activity or phishing attempts.
Site operators that collected visitor data through Studio forms may need to notify those individuals. Studio continues to issue updates on exact affected numbers and ongoing investigations. Users should review the official notices on studio.design for the latest guidance.
Frequently asked questions
Is Studio legit after the 2026 incident?
Studio remains an operational service with over 900,000 registered users. The company has disclosed the breach, fixed the vulnerability, and reported to regulators, though external verification of its remediation steps is still underway.
What form data was exposed in the Studio breach?
Stored form submissions, including active and trashed responses plus attachment file names, were potentially accessible. Externally embedded forms and fully deleted items predating September 30 were not affected.
Should users rotate API keys after the Studio incident?
Yes. Studio explicitly recommends creating new third-party tokens before revoking old ones for services such as Notion, microCMS, and Google Sheets. This order prevents service disruption during rotation.
How many organizations disclosed impact from the Studio breach?
Nearly 100 organizations had publicly reported potential exposure by late October 2026. Notable examples include the Digital Agency, Luup, Raksul, and Link-U Group.
TrustScope
Comments 2