Studio Security Review: Cloud Breach Exposes User Data and API Keys

Studio security review examines the unauthorized access incident that affected the Japanese no-code website builder between September 30 and October 1, 2026. Attackers exploited a platform vulnerability and retained access to data until October 14. The company confirmed the exposure on October 16 and advised immediate user actions.

The breach impacted all registered accounts, including usernames, emails, hashed passwords, site designs, CMS content, and stored form submissions. Third-party API keys, Google Sheets credentials, webhook URLs, and reCAPTCHA settings were also accessible. Many items were encrypted, yet the decryption key was compromised as well.

Timeline and Scope of the Studio Data Breach

Internal teams identified the issue on October 13. Studio closed the access route and patched the vulnerability by October 14. The company replaced its own credentials and encryption key on October 17 while re-encrypting older records. No evidence of data alteration or deletion has been found.

More than 900,000 registered users and over 220,000 published sites fell within the affected scope. Early-access applicants from 2022–2023 who never created accounts may also have had limited email and username data exposed. Japan’s Personal Information Protection Commission asked organizations planning separate notifications to coordinate with Studio on a possible joint report.

Corporate customers reported specific submission counts, such as 21,368 forms from Luup and 7,663 from Link-U Group. Studio continues forensic work with external experts and has not confirmed whether any data left the environment.

Privacy Concerns and Required User Actions

Exposed third-party credentials create ongoing risks even if no exfiltration occurred. Attackers could have copied API tokens, proxy keys, or webhook endpoints during the two-week window. Hashed passwords and page-protection passwords require rotation to limit reuse potential.

Studio recommends the following steps for all users:

• Change the Studio account password unless social login is active.
• Delete and regenerate all live preview URLs.
• Rotate every third-party API key, token, Google Sheets connection, and webhook URL stored in sites.
• Monitor connected services for unusual activity.

Targeted emails were sent to users of affected features. Organizations using Studio for client sites should verify whether any form data included personal information that triggers local notification rules.

Trust Assessment After the Incident

Studio acted quickly once the issue was detected and published detailed notices with updates through October 18. The platform’s domestic market position as a leading no-code CMS in Japan does not eliminate the need for users to reassess stored credentials. Continued investigation results and any joint regulatory filings will provide further clarity on the actual scope of access.

Businesses and freelancers relying on Studio should treat the event as a data exposure until proven otherwise and complete all recommended rotations without delay.