[Investigating][Severity: Critical][Web app exploit]

Studio: unauthorized access to the cloud environment of the Studio website builder

On 16 October, Studio, which runs the no-code website builder of the same name, said a vulnerability in some features was exploited to access its cloud environment from 30 September to 1 October. Until its fix on 14 October, data in the environment could be fetched from outside, and account data of all registered customers (including hashed passwords), form submissions, CMS content and API keys of connected services may have leaked. Keys to decrypt encrypted data were read too. Companies that used its forms disclosed their own impact. On October 22 the Digital Agency also disclosed potential exposure of form submissions and staff or contractor accounts. SmartHR's group also disclosed on October 22 possible exposure of 2,012 inquiry-form users across five companies; data in SmartHR and the group's other cloud services is excluded. Tamura City also disclosed possible exposure of 465 form submissions on October 22. Chiba Prefecture (26 people and 111 businesses across four programs), Nagano Prefecture (341 entries across three programs), Nagoya City (886 applications to a smoking cessation program) and ReFact and ThinQ Healthcare of the Speee group also disclosed possible exposure. The Digital Agency's scope was up to 13,323 submissions to five inquiry forms from May 2021 to March 2023. Tohoku EPCO Frontier also disclosed possible exposure of 182 submissions on its event site forms. Susaki City (3 contact form submissions) and Hiroshima Prefecture (2 submissions for a contracted program) also reported possible exposure. On 26 October Money Forward also said contact form entries on sites of four group firms may have leaked: 4,150 for Money Forward, 2,984 for Money Forward Kessai, 713 for Money Forward Home and 257 for Money Forward X. On the 20th Toho Gas also said 100 entries from forms of its new businesses (Shine Muscat grape growing and the Ielabo custom-home matching service) may be affected.

Disclosed

2026-10-16

Organizations involved

Leaked or at risk

Unknown

Downtime

Unknown

Timeline

Started 2026-09-30
Detected 2026-10-13
Disclosed 2026-10-16
16 days

Attack or cause

Method: [Web app exploit]
Impact: [Data leak]
Entry point: Web app

Data exposed or at risk

[Name][E-mail address][Phone number][Postal address][Passwords][Employment][Health data]

Services hit

[Breached][Critical]
Studio
[Through a supplier][Major]
Compl
Form submissions on its product site; data in the service itself is not affected.
[Through a supplier][Major]
Ielab
[Through a supplier][Major]
Nurikae
Form submissions on its introduction site for businesses.
[Through a supplier][Major]
RAKSUL
Form submissions on its service information sites; members, orders and payments of the print shop are not affected.
[Through a supplier][Major]
Saiattack
[Through a supplier][Major]
Tsuribaka City SUSAKI
[Through a supplier][Major]
TVer Ads
[Through a supplier][Major]
WorQ
Form submissions on its product site; data in the service itself is not affected.

Service	Role	Impact level	Note
Studio	[Breached]	[Critical]
Compl	[Through a supplier]	[Major]	Form submissions on its product site; data in the service itself is not affected.
Ielab	[Through a supplier]	[Major]
Nurikae	[Through a supplier]	[Major]	Form submissions on its introduction site for businesses.
RAKSUL	[Through a supplier]	[Major]	Form submissions on its service information sites; members, orders and payments of the print shop are not affected.
Saiattack	[Through a supplier]	[Major]
Tsuribaka City SUSAKI	[Through a supplier]	[Major]
TVer Ads	[Through a supplier]	[Major]
WorQ	[Through a supplier]	[Major]	Form submissions on its product site; data in the service itself is not affected.

Organizations involved

[Through a supplier][Critical]Tokyo, ChiyodaNational government13,323 leaked
Digital Agency
Up to 13,323 submissions to five inquiry forms from May 2021 to March 2023 (8,833 general opinions, 3,661 on the vaccination certificate app and more), plus 35 staff and contractor Studio accounts.
[Through a supplier][Critical]Aichi, Nagoya, NakaMunicipality886 leaked
Nagoya City
886 applications to its smoking cessation program from July 14, 2025 to August 31, 2026, stored on Studio by contractor Linkage (names, addresses, birth dates, smoking and medication status, medical history and more).
[Breached][Critical]Tokyo, MeguroInformation and communications
Studio Inc.
[Through a supplier][Major]Chiba, Chiba, ChuoPrefecture26 leaked
Chiba Prefectural Government
Form data from four contracted programs: 26 people (15 Chiba-bu inquiries, 11 DX training participants) and 111 businesses.
[Through a supplier][Major]Hiroshima, Hiroshima, NakaPrefecture2 leaked
Hiroshima Prefecture
The contractor for its sports talent program used Studio for its website; 2 of the contractor's 59 contact form submissions, those about the program, may have leaked names, affiliations, emails and phone numbers.
[Through a supplier][Major]Nagano, NaganoPrefecture341 leaked
Nagano Prefectural Government
341 entries with company names, names, phone numbers, email addresses and inquiries from forms of three industry and labor programs.
[Through a supplier][Major]Tokyo, MinatoInformation and communications4,150 leaked
Money Forward, Inc.
Contact form entries on some of its sites.
[Through a supplier][Major]Niigata, Niigata, ChuoMunicipality59 leaked
Niigata City
8 inquiries to its business efficiency expert program and 59 to its home teleworker training program.
[Through a supplier][Major]Toyama, ToyamaManufacturing1,024 leaked
and US Inc.
Personal data from the contact forms of its corporate and recruitment sites (including business sales contacts).
[Through a supplier][Major]Tokyo, ShinjukuInformation and communications
Hakky Inc.
Data sent through the contact, document request, job application and other forms on its corporate site from 2 July 2025 to 14 October 2026.

						Note
Digital Agency	[Through a supplier]	[Critical]	Tokyo, Chiyoda	National government	13,323	Up to 13,323 submissions to five inquiry forms from May 2021 to March 2023 (8,833 general opinions, 3,661 on the vaccination certificate app and more), plus 35 staff and contractor Studio accounts.
Nagoya City	[Through a supplier]	[Critical]	Aichi, Nagoya, Naka	Municipality	886	886 applications to its smoking cessation program from July 14, 2025 to August 31, 2026, stored on Studio by contractor Linkage (names, addresses, birth dates, smoking and medication status, medical history and more).
Studio Inc.	[Breached]	[Critical]	Tokyo, Meguro	Information and communications	Unknown
Chiba Prefectural Government	[Through a supplier]	[Major]	Chiba, Chiba, Chuo	Prefecture	26	Form data from four contracted programs: 26 people (15 Chiba-bu inquiries, 11 DX training participants) and 111 businesses.
Hiroshima Prefecture	[Through a supplier]	[Major]	Hiroshima, Hiroshima, Naka	Prefecture	2	The contractor for its sports talent program used Studio for its website; 2 of the contractor's 59 contact form submissions, those about the program, may have leaked names, affiliations, emails and phone numbers.
Nagano Prefectural Government	[Through a supplier]	[Major]	Nagano, Nagano	Prefecture	341	341 entries with company names, names, phone numbers, email addresses and inquiries from forms of three industry and labor programs.
Money Forward, Inc.	[Through a supplier]	[Major]	Tokyo, Minato	Information and communications	4,150	Contact form entries on some of its sites.
Niigata City	[Through a supplier]	[Major]	Niigata, Niigata, Chuo	Municipality	59	8 inquiries to its business efficiency expert program and 59 to its home teleworker training program.
and US Inc.	[Through a supplier]	[Major]	Toyama, Toyama	Manufacturing	1,024	Personal data from the contact forms of its corporate and recruitment sites (including business sales contacts).
Hakky Inc.	[Through a supplier]	[Major]	Tokyo, Shinjuku	Information and communications	Unknown	Data sent through the contact, document request, job application and other forms on its corporate site from 2 July 2025 to 14 October 2026.

Open in organization search

Sources

[1][Official]Studioにおける不正アクセスに関するご案内Studio
[2][News]人気Web制作ツール「Studio」全ユーザーの情報漏えいか　フォームに送信された内容、外部APIキーなどもITmedia NEWS · 2026-10-16
[3][Official]Webサイト制作サービス「Studio」への不正アクセスに伴う、当社Webフォームに送信された個人情報流出の可能性についてLuup · 2026-10-16
[4][Official]Studio株式会社で発生した不正アクセスに伴う個人情報漏えいの可能性に関するお知らせLink-U Group · 2026-10-16
[5][Official]【重要】当社が利用するWebサイト制作サービス「Studio」への不正アクセスに関するお知らせTVer · 2026-10-20
[6][News]新潟市の2事業で問い合わせた個人や法人の名前など67件が流出かThe Asahi Shimbun · 2026-10-19
[7][Official]Studio株式会社における不正アクセスによる個人情報の漏えいの可能性についてDigital Agency · 2026-10-22
[8][Official]ノーコードWeb制作プラットフォーム「Studio」への不正アクセスに伴う情報流出の可能性に関するお知らせSmartHR · 2026-10-22
[9][News]個人情報465件漏えいか田村市の委託業者使用サービスFukushima Minpo · 2026-10-23
[10][Official]当社が利用するクラウドサービスにおける不正アクセスに関するお知らせRAKSUL · 2026-10-16