Guidance by Feature

API Integrations: Data Connect API and API Connect (Beta)

• Have my API keys been exposed?

  arrow_drop_up

  Third-party API keys and tokens registered in Data Connect API and API Connect (Beta) settings may have been read, even where they were stored encrypted, because the key needed to decrypt them was also accessed.

• What should I do to prevent unauthorized use of my third-party API keys?

  arrow_drop_up

  To prevent unauthorized use by a third party, please rotate your keys in the following order.

  1. Issue new keys in each service (such as microCMS or Notion)

  2. Update your Studio.Design settings with the new keys

     – For Data Connect API: in the Design Editor, open the [Connect] panel, open [Authentication] for the API, and update the value with the new key

     – For API Connect (Beta): on the API editing screen, update the key registered in the header with the new key

  3. Revoke the old keys in each service

  If you revoke the old keys first, the integration on your site may stop working. If keys for third-party services you no longer use are still registered, we also recommend revoking them in each service.

  Please also check the usage history of each service for any activity you don’t recognize since September 30, 2026. If you find any, please let both the service provider and us know through our inquiry form.

  For the steps, see Data Connect API (API Integration) / What is API Connect (Beta)?.

Forms

• Have my form submissions been exposed?

  arrow_drop_up

  They may have been exposed. Form submissions we hold may have been read, even where they were stored encrypted, because the key needed to decrypt them was also accessed during the same unauthorized access.

  For attached files, only the file names are included, not the file contents.

  On October 16, 2026, we sent individual emails listing the affected project names to the owners of projects that use forms.

  If you sync form responses to Google Sheets, please also see “Q. I use the Google Sheets integration. What should I do?”

  この質問

  Related questions

  I use the Google Sheets integration. What should I do?

• (Japan's privacy law) We collect personal information through our forms. How do we report this to the Personal Information Protection Commission of Japan?

  arrow_drop_up

  On October 20, 2026, we announced the following on our page for customers who use forms.

  Regarding data breach reports to the Personal Information Protection Commission of Japan (PPC), following consultation with the PPC, you can now choose either to report to the PPC yourself individually, or to have Studio.Design compile the reports and submit a joint report in the names of both you and Studio.Design.

  ■ If you would like to submit a joint report

  Studio.Design will compile the reports and submit a joint report in the names of both you and Studio.Design. If you apply using the method we will announce, you do not need to submit an individual report. We will announce how the reports will be compiled and how to apply after consulting with the PPC.

  In addition, if you submit a joint report using the method determined in consultation with the PPC, it will not be treated as a late report, for this incident only, even if the standard timeframe for the preliminary report has passed.

  ■ If you would like to report individually

  Regardless of our October 17 request to hold off on reporting, you can report to the PPC yourself.

  If you have already reported individually, the PPC has received your report. You can also switch to the joint report. In that case, you do not need to submit a final report individually.

  ■ What we will announce

  We will announce how to apply and the application period as soon as they are decided. If you would like to submit a joint report, please apply at that time.

  The joint report covers only the report to the PPC. It does not include notifying the people who submitted the form (data subjects). If notification is required, please continue to consider how you will handle it. For details, see “Q. (Japan's privacy law) Am I required to notify the people who submitted my form?”

  For information about your affected projects and this incident, please check the individual emails we sent you. If you can’t find the email or need more information, please contact us through the inquiry form for this incident.

  For details and future updates, see “For customers who use forms: Information about reporting to the Personal Information Protection Commission” (in Japanese).

  この質問

  Related questions

  (Japan's privacy law) Am I required to notify the people who submitted my form?

• (Japan's privacy law) Am I required to notify the people who submitted my form?

  arrow_drop_up

  If personal information you collected through forms is affected by this incident, you may be required under Japan's Act on the Protection of Personal Information to notify the people who submitted the form (data subjects).

  Our October 17, 2026 notice (in Japanese) asked you to hold off only on reporting to the Personal Information Protection Commission. Notifying the people who submitted the form (data subjects) is not included in that request.

  When considering whether notification is required, please check the following three points.

  ① Were you using the form for business or organizational activities?

  This includes inquiries, reservations, and job applications. Sole proprietors and nonprofit organizations may also be covered.

  Basis: General Rules Guidelines 2-5 “Business operator handling personal information” (in Japanese)

  Excerpt (unofficial translation): “a person who uses a personal information database, etc. for business”

  ② Did the form responses contain “personal data”?

  Check whether they contain information that can identify an individual, such as names or contact details, including in free-text fields. If responses containing such information are saved on your Studio.Design dashboard, they are generally considered “personal data,” even if you have not created a separate list yourself.

  Basis: General Rules Guidelines 2-4 “Personal information database, etc.” and 2-6 “Personal data” (in Japanese)

  Excerpt (unofficial translation): “personal information that makes up a personal information database, etc.”

  Reference: Managing Form Responses in the Dashboard

  ③ Could that information be affected by this incident?

  Check the affected projects listed in the individual emails we sent you and the information you collected through your forms. Because there is no minimum number of people for breaches caused by acts with a wrongful purpose, if there is a risk of a breach due to unauthorized access, notification may be required even if only one person is affected.

  Basis: General Rules Guidelines 3-5-3-1 (3) “Situations subject to reporting” and 3-5-4-1 “Situations subject to notification and the party obligated to notify” (in Japanese)

  Excerpt (unofficial translation): “a situation in which a breach, etc. has occurred or is likely to have occurred”

  *Each excerpt is part of the original text of the relevant section. This checklist is for reference only. Please decide for yourself whether notification is required, and what and how to notify, based on the laws, the guidelines, and how you use your forms. Consult a lawyer or other expert as needed.

  We have prepared a press release template for businesses that you can use for announcements on your own website and elsewhere. Please edit it to suit the information involved and your situation before use. Note that, separately from an announcement on your website, you may be required to notify the people who submitted the form (data subjects). For details, see General Rules Guidelines 3-5-4 “Notification to the data subject” (in Japanese).

  View the press release template (in Japanese)

  If you have questions about your affected projects or our notices, or if you would like individual guidance, please contact us through the inquiry form for the unauthorized access.

  この質問

  Related questions

  (Japan's privacy law) Do I need to notify people even for responses that are sales pitches, spam, or raise safety concerns?

• (Japan's privacy law) Do I need to notify people even for responses that are sales pitches, spam, or raise safety concerns?

  arrow_drop_up

  You cannot exclude responses from notification based only on the purpose or content of the submission.

  If a response contains information that can identify a specific individual, such as a name or email address, notification to that person is generally required. On the other hand, responses that cannot identify a specific individual, such as meaningless strings submitted automatically, may not be subject to notification in the first place.

  If notification is difficult, for example because the response contains no contact information or the person cannot be reached, alternative measures such as a public announcement are permitted.

  If there are safety concerns, such as a death threat, please consult a lawyer or other expert, or the police, about how and when to notify.

  Basis: Guidelines (General Rules) 3-5-4 “Notification to the data subject” (in Japanese)

• Which form responses are affected?

  arrow_drop_up

  Form responses that were saved in Studio.Design are affected. This includes responses saved in Studio.Design even if they are not shown on the dashboard.

  Affected responses

  • Responses received on the dashboard

  • Responses moved to Trash (and not removed with “Delete permanently”)

  • Responses submitted as tests from Live Preview

  • Responses whose content could not be displayed on the dashboard because they exceeded your plan’s limit

  Responses not affected

  • Responses submitted while “Save form responses to Studio.Design” was turned off (because they are not saved in Studio.Design)

  • Responses removed with “Delete permanently” before September 30, 2026

  Even if you turned off “Save form responses to Studio.Design” partway through, responses that reached the dashboard before then remain and are affected.

  For attached files, only the file names are included, not the file contents.

  If you sync form responses to Google Sheets, the credentials used for the sync may also have been exposed, regardless of your Studio.Design save setting. We are asking you to stop the sync, so please see “Q. I use the Google Sheets integration. What should I do?”

  The affected projects are listed in the individual emails we sent on October 16, 2026. If you can’t find the email or aren’t sure whether your projects are affected, please contact us through the inquiry form for the unauthorized access.

  この質問

  Related questions

  I use the Google Sheets integration. What should I do?

• Am I affected if I embed a form from an external service on my Studio.Design site?

  arrow_drop_up

  If you embed a form from an external service (such as Google Forms), responses are sent directly from the visitor’s browser to the external service without passing through Studio.Design. Responses received by the external service are not held by Studio.Design, so they are not included in the information that may have been exposed.

  However, the embed code you pasted into Studio.Design is included in the information that may have been exposed, as part of your Design Editor content. If the embed code contains values that must not be disclosed, such as API keys or tokens, please replace those values with new ones in the external service.

  Embed codes for typical forms contain only information that can also be seen on your published site, such as the form URL.

• Are form responses that I didn’t save in Studio.Design affected?

  arrow_drop_up

  Responses submitted while “Save form responses to Studio.Design” was turned off are not saved in Studio.Design, so they are not included in the information that may have been exposed. We also do not store the contents of the notification emails that tell you about responses.

  However, please check the following cases.

  • If you turned it off partway through: Responses that reached the dashboard before then are kept until you remove them with “Delete permanently,” so they are affected.

  • If you sync to Google Sheets: The credentials used to write responses to the spreadsheet may have been exposed. We are asking you to stop the sync, so please see “Q. I use the Google Sheets integration. What should I do?”

  For the detailed scope of affected responses, see “Q. Which form responses are affected?”

  この質問

  Related questions

  Which form responses are affected?

• I use the Google Sheets integration. What should I do?

  arrow_drop_up

  The credentials used for the sync may have been exposed. However, on October 14, 2026, we updated the key required for the connection, so the credentials that may have been exposed can no longer be used. The sync continues to work as is, and form responses will continue to be added to the spreadsheet.

  To be thorough, we recommend setting up the sync again with the following steps.

  1. In Studio.Design, stop the sync with the spreadsheet

  2. Remove Studio.Design’s access in your Google Account at https://myaccount.google.com/linkedapps

  3. If you want to keep managing responses in a spreadsheet, set up the sync again. A new sheet will be created, and future responses will be added there

  If you have already stopped the sync as requested in our October 16, 2026 email, please complete steps 2 and 3.

  Between stopping the sync and setting it up again, responses will not be added to the spreadsheet. How you receive responses during that time depends on the “Save form responses to Studio.Design” setting in your form settings.

  • If it’s on: responses are saved to your Studio.Design dashboard as usual.

  • If it’s off: responses are sent only to your notification email addresses. Before stopping the sync, make sure a notification destination is set.

  Removing access in your Google Account also stops responses from being added to spreadsheets for other projects synced with the same Google Account. For projects where you want to keep using the sync, set it up again in the same way.

  For Google Workspace accounts, your organization’s settings may require administrator approval to set up the sync again. If you can’t set it up, please check with your organization’s administrator.

  For the steps, see Manage form responses with Google Sheets / Manage form responses: Receive email notifications only.

• Could sheets other than the one connected through the Google Sheets integration also be affected? What are the potential risks?

  arrow_drop_up

  Because we updated the key, the credentials that may have been exposed can no longer be used by a third party.

  Synced sheets

  Because the credentials used for the sync and the sheet IDs may both have been exposed, we cannot rule out the possibility that a third party could view or edit the sheet until October 14, 2026, when we updated the key required for the connection.

  Sheets that were not synced

  These credentials can only be used to work with spreadsheets whose IDs are known. They cannot be used to list or search for spreadsheets. For the sync, we held only the IDs of the synced sheets.

  Therefore, a sheet that was not synced could be affected only if a third party learned its ID in ways such as the following:

  • The synced sheet contained the URL of that sheet

  • You shared the URL through a public link or similar means

  How to check

  In the relevant sheet, go to “File” > “Version history” > “See version history” and check for any edits you don’t recognize, other than added form responses, between September 30 and October 14, 2026. Viewing alone is not recorded in the version history. If you use Google Workspace, an administrator may be able to check viewing activity in the audit logs in the Admin console (Drive log events).

  Find what’s changed in a file / Drive log events

Password-Protected Pages

• Have the passwords for my password-protected pages been exposed?

  arrow_drop_up

  The passwords you set were stored in hashed form. Recovering the original password is difficult, but we cannot completely rule out the possibility, so we ask you to change the password as a precaution.

  After changing it, please share the new password with the people who view the pages.

  Note that the content of password-protected pages is also included in the information that may have been exposed (data you manage on Studio.Design).

  For how to change it, see Protect your entire site with a password.

• How do I change the password for a password-protected page?

  arrow_drop_up

  After changing it, please share the new password with the people who view the pages.

  Note that the content of password-protected pages is also included in the information that may have been exposed (data you manage on Studio.Design).

  For how to change it, see Protect your entire site with a password.

Custom Proxy Keys

• Have my custom proxy keys been exposed?

  arrow_drop_up

  They may have been exposed. To prevent unauthorized use by a third party, we have issued new custom proxy keys.

• What should I do to prevent unauthorized use of my custom proxy keys?

  arrow_drop_up

  Open your project dashboard, go to [Settings] > [Custom] > [Custom Proxy], and check your new key. We have issued the new key and applied it to the affected projects.

  Please switch keys with the following steps.

  1. Replace the custom proxy key in the settings on your server (such as a reverse proxy or CDN) with the new key. Your site will continue to display as usual while you replace it. After replacing it, check that your site displays correctly.

  2. Once you have finished replacing the key, let us know through the inquiry form by selecting “Proxy key invalidation request” and entering the Studio.Design subdomain of the affected project in “Studio subdomain(s).” You don’t need to include the custom proxy key itself.

  3. We will revoke the old custom proxy key for each project after we hear from you, and we will let you know when it’s done.

  The old custom proxy key remains valid until it is revoked. To prevent unauthorized use by a third party, please replace the key and let us know as soon as possible. Please complete this within 30 days of receiving our October 16, 2026 email.

  Our first email on October 16 said that we would revoke the old custom proxy keys in turn for projects where we could confirm access with the new key. To make sure the switch is completed reliably, we have changed this so that you let us know once you have replaced the key. Even if you have already replaced it, please let us know.

Webhook Notifications

• Have my Webhook notification URLs been exposed?

  arrow_drop_up

  The notification URLs registered for Webhook notifications are also included in the information that may have been exposed, as data you manage on Studio.Design.

  A third party with access to the URL may be able to send messages to the registered destination. On October 16, 2026, we sent individual emails to the owners of projects that use Webhook notifications, recommending that they switch the notification URL.

• How do I switch the notification URL?

  arrow_drop_up

  As a precaution, we recommend switching the notification URL in the following order.

  1. Issue a new URL in the destination service (for a Slack Incoming Webhook, create a new Webhook URL)

  2. In your Studio.Design project dashboard, go to [Home] > [Project Settings] and update [Webhook] at the bottom with the new URL. Send a test notification to confirm that it arrives

  3. Disable the old URL in the destination service (for Slack, delete the old Webhook URL)

  If you disable the old URL first, notifications will stop arriving. If you no longer use Webhook notifications, clear the notification URL in Studio.Design and save, then disable the old URL in the destination service.

  Please also check whether any notifications you don’t recognize have arrived at the destination since September 30, 2026. Don’t open links in notifications you don’t recognize.

  For the steps, see Set up Webhook notifications.

reCAPTCHA

• Have my reCAPTCHA settings been exposed?

  arrow_drop_up

  Google reCAPTCHA v3 settings (including the secret key) are also included in the information that may have been exposed, as data you manage on Studio.Design. They may have been read, even where they were stored encrypted, because the key needed to decrypt them was also accessed during the same unauthorized access.

  For how to handle the secret key, see “Q. Should I also replace my Google reCAPTCHA v3 secret key?”

  この質問

  Related questions

  Should I also replace my Google reCAPTCHA v3 secret key?

• Should I also replace my Google reCAPTCHA v3 secret key?

  arrow_drop_up

  At this time, we are not asking all customers to replace their secret key.

  The secret key is used to check with Google that a form submission was not made by a bot. This key alone cannot be used to view form responses or to access your Google account or the reCAPTCHA admin console. Also, Studio.Design checks Google’s result every time a form is submitted, so knowing the key alone does not allow a third party to get past this check.

  Note that form submissions themselves are included in the information that may have been exposed, separately from this key (see the “Forms” section).

  Because the key may have been exposed, you can switch to a new key as a precaution if you are concerned.

  However, if a third party used this key to send a large number of verification requests to Google, your reCAPTCHA quota could be used up and your forms might no longer be able to be submitted. We cannot rule this out. If your forms can no longer be submitted, or if you see an unexpected increase in usage in the reCAPTCHA admin console, please switch to a new key with the following steps.

  1. In the Google reCAPTCHA Admin Console, create a new key (reCAPTCHA v3). Register your published site’s domain and preview.studio.site as domains

  2. In your Studio.Design project dashboard, go to [Home] > [Apps] > [Google reCAPTCHA v3], update the site key and secret key with the new ones, and save

  3. Confirm that you can submit forms on Live Preview and on your published site

  4. Once confirmed, delete the old key in the Admin Console

  If you delete the old key first, your forms will no longer be able to be submitted. If you use the same key on other sites, update those settings as well.

  For details, see Apps Integration: Setting Up Google reCAPTCHA v3.