SaaS
4 articles with this tag
Unauthorized Access to the Studio Website Builder: All Users' Data and Form Submissions May Have Leaked — What Form Senders and Site Owners Should Do
On October 16, 2026, Studio Inc. announced that a third party had gained unauthorized access to the cloud environment it uses, and that data on every customer registered with its website builder Studio may have been leaked. The third party exploited a vulnerability in some Studio features to access the environment and made its data retrievable from outside. The confirmed period of unauthorized access is September 30 to October 1, 2026 (Japan time); the company found it in an internal investigation on October 13 and finished fixing the vulnerability and closing the route on October 13–14. Data that may have leaked includes account data (user names, email addresses, hashed passwords and more), design editor and CMS content, the contents of forms submitted on Studio-built sites, live preview URLs, API keys and tokens for external services registered in API integrations, passwords of password-protected pages, and webhook notification URLs. Some data stored encrypted may also have been read, because the key needed to decrypt it was read in the same access. The company has not confirmed that a third party actually took the data, but is treating it as taken. The number of people affected and whether any misuse has occurred are under investigation. Companies and organizations that built sites with Studio have also said that personal data sent through their forms may have leaked: Luup gave 21,368 records, Link-U Group 7,663, TRUSTART about 1,440 and Saitama Prefecture's Saitama Green Forest Museum 162. On October 17, at the request of Japan's Personal Information Protection Commission (PPC), Studio Inc. asked form users to put their individual reports to the PPC on hold (notifying the affected individuals is not on hold). This site's conclusion: if you sent a form on a Studio-built site, check that site owner's notice and do not open links in messages that mention what you sent. Site owners should change their password and rotate integration keys in the order Studio Inc. gives.
Unauthorized Access to Arcadia's SpeeCAN RAIDEN (Up to About 3.136 Million Email Addresses, Estimated): Japanese Municipal Disaster-Alert Registrations May Have Leaked — What Subscribers Should Do
On October 13, 2026, Arcadia Inc. announced that SpeeCAN RAIDEN, its mass-notification service for email and other messages, was accessed without authorization by a third party, and that contact names, email addresses, phone and fax numbers, staff and contract information, and the text of delivered messages stored as history may have leaked. The maximum counts are about 3,136,000 email addresses, about 105,000 phone numbers and about 15,000 fax numbers (all estimates, still under investigation). Arcadia saw suspicious activity at 16:30 on October 11, applied an interim block around 3:00 on October 12, and at 11:00 on October 13 shut down the services that had been the intrusion route (raiden3, and s2 for Raiden School). On October 14 it added NET119 and 119RAIDEN to the possible leak, and in its 11th update on October 16 gave figures per service: for NET119, personal data such as names, dates of birth and addresses linked to 9,020 email addresses (it confirmed that no sensitive personal data leaked); for 119RAIDEN, about 97,000 email addresses and other data. The suspended services were restored around 15:00 on October 15. Payment data is not handled. Municipalities have issued their own notices; Shizuoka City says it has established that email addresses of 34,336 registered residents and other data leaked, and has seen fake emails posing as a card company sent from the same domain as the real alerts, @raiden.ktaiwork.jp. In its 17th update on October 21, Arcadia said a malicious program sent 1,423,428 phishing emails from its system between 1:17 and 7:16 on October 13, that at least 869,575 of them went to addresses the company does not hold, and that an outside organisation will carry out a dark-web survey. It has also emailed clients and resellers about filing the reports to the Personal Information Protection Commission and the Ministry of Internal Affairs and Communications on their behalf. Our conclusion: the sender cannot tell real from fake, so do not block the disaster-alert sender, and do not open links in emails asking you to confirm card or personal details.
Unauthorized Access to Commune (166,505 Member Records, Counted per Community): Member Data from Corporate Communities Leaked — What Members and Operators Should Do
On October 9, 2026, Commune Inc. announced that its community services for businesses, Commune and Commune for Work, were accessed without authorization by an outside third party, and that member data in some communities leaked. The leaks occurred from about 18:00 on October 5 to about 21:00 on October 6, and from 13:17 to 14:36 on October 7 (Japan time). Its first notice gave about 307,000 members (an estimate of unique people) as the maximum possibly affected. In a follow-up on October 21, after a detailed investigation, it confirmed that 166,505 members were affected (the total of member IDs counted per community, so people in several communities are counted once for each; this includes communities run by the company and test/demo communities, and excludes accounts created by the attacker), and that 125,601 of them had data including email addresses leaked. For the others, the leaked data includes display names, profiles and private group memberships. For 144 members, passwords were changed to temporary ones without their action. No leak of the passwords themselves or of direct messages was confirmed, and the company does not hold payment data. It attributes the incident to invitation links for private communities obtained illegitimately and to impersonation of administrators. Client companies that run communities on the service have also published notices; JMAM said the names, addresses, ages and phone numbers in member profiles on its Toki Labo community also leaked. To prevent misuse of the leaked email addresses, Commune Inc. stopped all communities for emergency maintenance from 00:50 on October 10 and took measures such as making two-factor authentication mandatory for administrator accounts. On October 16 it announced that communities would reopen in stages, starting with clients that ask, in the web browser version only and with some features restricted (the app, new registration with an email address and “forgot password” resets remain unavailable). It says no new unauthorized access or leak was found during the maintenance or testing. The October 21 follow-up also says the company filed a preliminary report with the Ministry of Internal Affairs and Communications (Kanto Bureau of Telecommunications) on October 9, has begun consulting the police, found no programs, accounts or settings left behind by the attacker after analysing all logs, and is preparing a forensic investigation by a third-party organisation. This site's take: check the notice of the company that runs your community to see whether you are affected, and do not open links in emails that claim to come from the community.
How 2026 Breaches in Japan Got In: More Through Valid Credentials Than Vulnerabilities (A Cross-Case Analysis)
Classified by entry path, the major Japanese incidents disclosed in August 2026 skew toward credential-led intrusion rather than exploited vulnerabilities. The shared trait: the victim's own servers were untouched and the way in was a legitimate account on an outside service. This site's conclusion: flawless vulnerability management stops none of this, so the focus has to shift toward credential lifetime and scope, and an inventory of the vendors and SaaS that can reach your data.