Studio security review: Cloud breach exposes form data and API keys

Studio, the Tokyo-based no-code website builder, reported unauthorized access to its cloud environment between September 30 and October 1, 2026. The incident allowed potential access to user account information, stored form submissions, and third-party API credentials across its customer base of more than 900,000 registered accounts.

Internal detection occurred on October 13. Engineers blocked external access and patched the vulnerability by October 14. The company issued a public notice on October 16 and updated it two days later. No confirmed cases of secondary data misuse have been reported as of October 20, 2026.

Timeline and scope of the unauthorized access

The attack window lasted roughly 24 hours in Japan Standard Time. Attackers exploited a vulnerability in certain platform features to reach the cloud environment. Studio engaged a forensic firm and continues to investigate the exact entry point and full scope of accessed files.

Every registered customer falls within the affected group. This includes users who published sites and individuals who applied for early access to Studio AI between December 2022 and August 2023 without creating full accounts. Roughly 250,000 published sites existed at the time of the incident.

Studio notified Japan's Personal Information Protection Commission and is cooperating with authorities. The commission asked the company to explore a joint reporting approach for affected form submissions, though individual notifications to data subjects are not suspended.

Types of data accessed and potential risks

Account information included usernames, email addresses, and hashed passwords. Site content such as designs and CMS elements was reachable. Stored form submissions, including responses moved to trash and test entries, were also exposed. File names appeared in logs, though actual file contents were not stored on the platform.

Live preview URLs, reCAPTCHA v3 settings, and webhook URLs formed part of the accessible data set. Third-party credentials presented the clearest immediate concern. These encompassed Google Sheets integration tokens, custom proxy keys, and API keys for external services. Most credentials were stored in encrypted form, yet the attackers obtained the decryption key, meaning contents may be readable.

Studio has not confirmed whether any data left its systems. The company is treating the accessed information as potentially exfiltrated. No evidence of data alteration or deletion appears in available logs. Re-encryption of older stored data is now underway.

Public examples of form volumes at risk include 21,368 submissions from Luup, 7,663 from Link-U Group, and 6,412 from Raksul. Smaller numbers appear for several government contractors. These figures count submissions rather than unique individuals.

User actions and next steps for account protection

Studio recommends that all users change their platform password right away, especially if the same password appears on other services. Targeted emails were sent to accounts that used specific features such as Google Sheets integration or protected pages.

Additional steps include deleting and regenerating live preview URLs, rotating any third-party API keys or webhook endpoints that were stored in Studio, and reviewing Google Sheets connections. Users should monitor associated email inboxes and external services for unusual activity.

The company replaced its own internal credentials and the encryption key on October 17. Investigation remains active, and updated guidance will be issued as forensic findings become available. Customers with form data on the platform should review their own privacy obligations under Japanese regulations, as unauthorized access to personal information triggers notification requirements regardless of volume.