Studio breach may have exposed every account's API keys and form data

Studio breach may have exposed every account's API keys and form data

22 October 2026: Studio, the Japanese no-code website builder, says an attacker who exploited a flaw in some of its features reached its cloud environment and left the data there open to retrieval, and that every registered customer's account details, site content, form submissions and stored third-party API keys may have leaked. The decryption key for the encrypted fields was read in the same intrusion, so Studio is asking customers to treat their stored secrets as known and to rotate them themselves.

Not yet independently verified. Studio has not said how many accounts or form answers are affected, has not described the vulnerability, and says it has not confirmed that data was actually taken; it is treating it as taken. We will update this when it can be confirmed, and remove this note.

What the attacker could reach

Studio's first report, published on 16 October and updated daily since, puts the confirmed access at 30 September and 1 October, Japan time. Its own investigation found the intrusion on 13 October, and by 14 October it had fixed the vulnerability, closed the route and logged out every user. It says it has not confirmed that data was actually taken but is proceeding as if it was, and it has found no tampering or deletion of customer data.

The list of what may have leaked covers every registered customer:

• account details: user name, email address and hashed password;
• data managed in Studio: design editor and CMS content, form submissions, reCAPTCHA v3 settings and webhook URLs;
• live preview URLs for unpublished pages;
• credentials in settings: API keys and tokens for connected external services, passwords for password-protected pages, Google Sheets connection credentials and custom proxy keys.

Form answers in scope include those in the bin, test submissions from live previews and answers hidden because a plan's limit had been reached; answers sent while saving to Studio was switched off, and forms embedded from services such as Google Forms, are not. For attachments only file names are affected. People who applied for early access to its AI site builder between December 2022 and August 2023 are also affected, including some without an account.

A government site among the customers

Japan's Digital Agency, which ran its website on Studio, said on 22 October that inquiry form messages sent to it between May 2021 and March 2023 may have leaked: up to 8,833 general comments, 3,661 questions about the vaccination certificate app, 462 workshop registrations, 250 employment inquiries and 117 requests to rent its mascot costume, plus the names and email addresses of 35 staff and contractors with Studio accounts. It has seen no misuse so far and warned people to expect phishing in its name.

What site owners have to do

Studio rotated its own credentials, switched to a new encryption key for new data on 17 October and is re-encrypting older data, but it cannot revoke keys that customers issued in other services. Owners who connected APIs, Google Sheets or webhooks need to revoke and reissue those keys at the provider and update them in Studio; owners of password-protected pages should change those passwords; and owners who collected personal data through Studio forms have their own reporting duty. Studio told form users on 17 October that it is reporting to Japan's Personal Information Protection Commission itself and that they should hold off on separate reports while it confirms the details.

Our website builder software category lists 20 products and our no-code platform category 11.

Company profile on TrustList: Studio

Related on TrustList:

• Pleasanter fixes LDAP login bypass CVE-2026-113438 in 1.5.9.1

Sources

• Studio: 不正アクセスによる情報流出に関するお詫びとお願い（第一報）, 16 October 2026
• Studio: incident information page (updated 20 October 2026), 20 October 2026
• Digital Agency (Japan): possible leak of personal information due to unauthorised access at Studio Co., Ltd., 22 October 2026