Unauthorized Access to the Studio Website Builder: All Users' Data and Form Submissions May Have Leaked — What Form Senders and Site Owners Should Do

Studio is a service companies, local governments and organizations use to build their own websites. If you sent a form, you sent your data to the organization that runs the site, not to Studio. So whether you are affected depends on which site's form you used.

Open the notice for the site you contacted in the "Check whether you are affected" table below. For organizations not in the table, check the news section of their official site. According to Studio Inc., people who sent forms may be contacted by the site owner. The company also takes questions through its "unauthorized access inquiry" form (reachable from its guidance page, in Japanese).

People write more than their name and email in forms. Company names, phone numbers, addresses and the details of their question are common, and Uzabase's notice lists date of birth, gender, career history and income.

A message from someone who knows those details looks real. Even if an email, SMS or call refers to something you actually sent ("about your recent inquiry", "thank you for requesting our brochure"), do not open its links or attachments; check through the contact details on the official site you open yourself (how to spot it: What is phishing?).

If you wrote your phone number or address in a form, consider that calls or letters claiming to come from a company are possible too, not just email. Several client companies state in their notices that they never ask for passwords or credit card numbers by email or phone. If asked, hang up and call back on the number listed on the official site.

Studio Inc. says the email address, user name and country of residence (estimated by the company from the IP address used to apply) of people who applied for early access to its AI site-building feature "Studio AI" (first called "Auto") between December 2022 and August 2023 may also have leaked, and it is contacting them individually. The subject line is (in Japanese) "【重要】不正アクセスによる、先行利用のお申し込み情報の流出に関するお詫び". No passwords or payment details were collected in that application, so no password change is needed, the company says.

This applies if you log in with an email address and password. The company strongly recommends also changing the password on other services where you used the same one. If you only use Google or Facebook login and have never set a Studio password, this is not needed.

However, the company says that if you ever registered or logged in with an email and password, a password may be set; in that case reset it from "Forgot your password?" on the login screen. For what hashing means, see password hashing; to stop reusing passwords, see password managers.

The company has not confirmed that any issued live preview URL was identified, but cannot fully rule it out, so it asks owners to delete them. A deleted URL stops working. If you still need to share a preview, issue a new URL after deleting and send it again.

This applies if you registered API keys or tokens for external services (such as content and document services) in Data Connect API or API Integration (Beta). Keys for external services are managed by the issuing service, so Studio cannot disable them; owners must rotate them, the company says.

The order is: issue a new key in each service, update the Studio setting to the new key, and finally revoke the old key in each service. Revoking the old key first may stop the integration on your site. The company also recommends revoking keys for external services you no longer use. Check each service's usage history for any unexpected use since September 30, 2026 (why deleting is not enough and revoking is needed: credentials published on GitHub still worked).

The passwords were stored hashed, but the company cannot fully rule out their recovery, so it asks owners to change them. The content of password-protected pages is itself among the data that may have leaked. If you put confidential material behind a password, treat its content as known.

In its October 16 per-feature email, the company said that site owners who collected visitors' personal data through forms may, as businesses handling personal information, need to report to the PPC and notify the individuals.

Then on October 17, at the PPC's request, it asked customers to put individual reports to the PPC on hold. It plans to discuss whether it can compile reports and file them jointly with customers, and will announce the process and how deadlines are handled. Only the PPC report is on hold; notifying individuals is not. The company's guidance page lists points for deciding whether notification is needed (whether the form was used for business, whether responses contain personal data, whether the data may be affected) and a template for a notice on your own site. It also suggests consulting a lawyer or other specialist when unsure.

The company updated the key needed for the connection on October 14 and says credentials that may have leaked can no longer be used. To be more certain, it recommends disconnecting the integration in Studio, removing Studio's access on the "Linked apps" page of the Google account, and connecting again. For sheets that were linked, check the version history for any unexpected edits other than added responses between September 30 and October 14.

The company has issued a new proxy key and applied it to affected projects. Change the key in your own server settings (reverse proxy, CDN and so on) and tell the company's inquiry form when done; it will then disable the old key. The deadline is 30 days from receiving the October 16 email.

A third party who knows the URL may be able to send messages to the destination. The company recommends creating a new URL in the destination service (such as a chat service’s incoming webhook), updating it in Studio's project settings and checking with "test send", then disabling the old URL. Also check for unexpected notifications since September 30, and do not open links in any you find.

If you already receive responses by email notification or in your own system, review whether you need to keep them in the Studio dashboard. If you do, set a period (for example, a set number of months after the inquiry is handled) and, once it passes, export and then "permanently delete" them. Moving them to the trash is not deleting them.

When you move forms to another service or close a site, check that no data remains on the old service. TRUSTART also says it will review its procedure for deleting data when it stops using an external service.

In this case, owners were asked to change passwords, API keys, password-protected pages, the Sheets integration, proxy keys and webhook URLs. A list of which key is registered in which service for which project makes it harder to miss one next time (similar cases on the hosting side: when your web hosting provider is breached, unauthorized access to some ConoHa WING servers).