STUDIO
Pricing

Templates

UpdatesDiscordLearn

Login ／ Sign Up 

WHAT'S NEW

Updates

2026.10.21

News

[Important] Emergency maintenance starting at 10:00 PM JST (13:00 UTC) on October 21, 2026 (ended October 22, 4:05 AM JST)

The emergency maintenance ended at 4:05 AM JST on October 22, 2026, and all features are available again. Unlike our earlier notice, the maintenance also affected some features of published sites, such as form submissions. Here are the details and what we ask you to check.

View details

2026.10.16

Information

[Important] Initial notice of unauthorized access and data exposure

An unauthorized third party accessed the cloud environment used by Studio.Design, and information we hold may have been exposed. The entry point used for the unauthorized access has already been closed. Here is what happened and the actions we ask you to take.

View details

2026.10.05

Product Updates

URLs, Unified

More control over your site URLs with www redirects and trailing slash settings for search engines.

View details

2026.09.28

Product Updates

August 2026 Product Updates

A smoother Editor experience, faster form submissions, accessibility improvements, and more.

View details

2026.09.28

Product Updates

July 2026 Product Updates

No monthly visitor limits, improved Google Analytics integration, a new way to review changes before updating your site, and more.

View details

2026.07.07

Product Updates

June 2026 Product Updates

A faster publishing infrastructure, official CHILLNN integration, usability improvements, bug fixes, and more.

View details

2026.06.11

Product Updates

Speed Meets Search

New publishing infrastructure now generally available.

View details

2026.03.24

Information

Bold New Characters

7 New Font Families (25 Fonts) from Morisawa Added

View details

2026.03.24

Information

Manage the FONTPLUS Transition with Ease

Check the email notification and try bulk font replacement

View details

2026.03.19

Information

FONTPLUS Font Support Ending April 7, 2026

Review affected fonts and explore alternatives.

View details

ベータ版につき、全プランで利用可能

Early Accessに応募

Early Accessに応募

When will I get a reply?

We are accepting inquiries about this incident.
We accept inquiries 24 hours a day and reply in the order received, on weekdays from 10:00 to 18:00 (JST). Please note that responses may take longer when we receive a high volume of inquiries.

When and to whom will notices be sent?

Notices about personal information registered with Studio.Design

  • We will send these to all affected user accounts by email or in-app notification.

Notices about specific projects

  • We will send these to the accounts with owner permissions for the project by email or in-app notification.

  • For some projects that had no owner because of an old account deletion process, we may send these to other accounts that belong to the project or workspace.

How do I contact you?

  • If you can sign in to Studio.Design:
    Open the Support Center from the help icon at the bottom left or right of the screen, go to “Messages” > “Send us a message,” and select “Inquiry about the unauthorized access.”

  • If you can’t sign in, only manage billing for the account, or don’t have a Studio.Design account:
    Submit the inquiry form for the unauthorized access.

  • If you received a notice from the operator of a site built with Studio.Design:
    For questions about what you submitted or how that site is handling it, please contact the operator of the site that sent you the notice.
    For questions about what we have announced, please check the FAQ on this portal first. If you still need to contact us, submit the inquiry form for the unauthorized access.

Should I also replace my Google reCAPTCHA v3 secret key?

At this time, we are not asking all customers to replace their secret key.

The secret key is used to check with Google that a form submission was not made by a bot. This key alone cannot be used to view form responses or to access your Google account or the reCAPTCHA admin console. Also, Studio.Design checks Google’s result every time a form is submitted, so knowing the key alone does not allow a third party to get past this check.

Note that form submissions themselves are included in the information that may have been exposed, separately from this key (see the “Forms” section).

Because the key may have been exposed, you can switch to a new key as a precaution if you are concerned.

However, if a third party used this key to send a large number of verification requests to Google, your reCAPTCHA quota could be used up and your forms might no longer be able to be submitted. We cannot rule this out. If your forms can no longer be submitted, or if you see an unexpected increase in usage in the reCAPTCHA admin console, please switch to a new key with the following steps.

  1. In the Google reCAPTCHA Admin Console, create a new key (reCAPTCHA v3). Register your published site’s domain and preview.studio.site as domains

  2. In your Studio.Design project dashboard, go to [Home] > [Apps] > [Google reCAPTCHA v3], update the site key and secret key with the new ones, and save

  3. Confirm that you can submit forms on Live Preview and on your published site

  4. Once confirmed, delete the old key in the Admin Console

If you delete the old key first, your forms will no longer be able to be submitted. If you use the same key on other sites, update those settings as well.

For details, see Apps Integration: Setting Up Google reCAPTCHA v3.

Have my reCAPTCHA settings been exposed?

Google reCAPTCHA v3 settings (including the secret key) are also included in the information that may have been exposed, as data you manage on Studio.Design. They may have been read, even where they were stored encrypted, because the key needed to decrypt them was also accessed during the same unauthorized access.

For how to handle the secret key, see “Q. Should I also replace my Google reCAPTCHA v3 secret key?”

How do I switch the notification URL?

As a precaution, we recommend switching the notification URL in the following order.

  1. Issue a new URL in the destination service (for a Slack Incoming Webhook, create a new Webhook URL)

  2. In your Studio.Design project dashboard, go to [Home] > [Project Settings] and update [Webhook] at the bottom with the new URL. Send a test notification to confirm that it arrives

  3. Disable the old URL in the destination service (for Slack, delete the old Webhook URL)

If you disable the old URL first, notifications will stop arriving. If you no longer use Webhook notifications, clear the notification URL in Studio.Design and save, then disable the old URL in the destination service.

Please also check whether any notifications you don’t recognize have arrived at the destination since September 30, 2026. Don’t open links in notifications you don’t recognize.

For the steps, see Set up Webhook notifications.

Have my Webhook notification URLs been exposed?

The notification URLs registered for Webhook notifications are also included in the information that may have been exposed, as data you manage on Studio.Design.

A third party with access to the URL may be able to send messages to the registered destination. On October 16, 2026, we sent individual emails to the owners of projects that use Webhook notifications, recommending that they switch the notification URL.

What should I do to prevent unauthorized use of my custom proxy keys?

Open your project dashboard, go to [Settings] > [Custom] > [Custom Proxy], and check your new key. We have issued the new key and applied it to the affected projects.

Please switch keys with the following steps.

  1. Replace the custom proxy key in the settings on your server (such as a reverse proxy or CDN) with the new key. Your site will continue to display as usual while you replace it. After replacing it, check that your site displays correctly.

  2. Once you have finished replacing the key, let us know through the inquiry form by selecting “Proxy key invalidation request” and entering the Studio.Design subdomain of the affected project in “Studio subdomain(s).” You don’t need to include the custom proxy key itself.

  3. We will revoke the old custom proxy key for each project after we hear from you, and we will let you know when it’s done.

The old custom proxy key remains valid until it is revoked. To prevent unauthorized use by a third party, please replace the key and let us know as soon as possible. Please complete this within 30 days of receiving our October 16, 2026 email.

Our first email on October 16 said that we would revoke the old custom proxy keys in turn for projects where we could confirm access with the new key. To make sure the switch is completed reliably, we have changed this so that you let us know once you have replaced the key. Even if you have already replaced it, please let us know.

Have my custom proxy keys been exposed?

They may have been exposed. To prevent unauthorized use by a third party, we have issued new custom proxy keys.

How do I change the password for a password-protected page?

After changing it, please share the new password with the people who view the pages.

Note that the content of password-protected pages is also included in the information that may have been exposed (data you manage on Studio.Design).

For how to change it, see Protect your entire site with a password.

Have the passwords for my password-protected pages been exposed?

The passwords you set were stored in hashed form. Recovering the original password is difficult, but we cannot completely rule out the possibility, so we ask you to change the password as a precaution.

After changing it, please share the new password with the people who view the pages.

Note that the content of password-protected pages is also included in the information that may have been exposed (data you manage on Studio.Design).

For how to change it, see Protect your entire site with a password.

Could sheets other than the one connected through the Google Sheets integration also be affected? What are the potential risks?

Because we updated the key, the credentials that may have been exposed can no longer be used by a third party.

Synced sheets

Because the credentials used for the sync and the sheet IDs may both have been exposed, we cannot rule out the possibility that a third party could view or edit the sheet until October 14, 2026, when we updated the key required for the connection.

Sheets that were not synced

These credentials can only be used to work with spreadsheets whose IDs are known. They cannot be used to list or search for spreadsheets. For the sync, we held only the IDs of the synced sheets.

Therefore, a sheet that was not synced could be affected only if a third party learned its ID in ways such as the following:

  • The synced sheet contained the URL of that sheet

  • You shared the URL through a public link or similar means

How to check

In the relevant sheet, go to “File” > “Version history” > “See version history” and check for any edits you don’t recognize, other than added form responses, between September 30 and October 14, 2026. Viewing alone is not recorded in the version history. If you use Google Workspace, an administrator may be able to check viewing activity in the audit logs in the Admin console (Drive log events).

Find what’s changed in a file / Drive log events

I use the Google Sheets integration. What should I do?

The credentials used for the sync may have been exposed. However, on October 14, 2026, we updated the key required for the connection, so the credentials that may have been exposed can no longer be used. The sync continues to work as is, and form responses will continue to be added to the spreadsheet.

To be thorough, we recommend setting up the sync again with the following steps.

  1. In Studio.Design, stop the sync with the spreadsheet

  2. Remove Studio.Design’s access in your Google Account at https://myaccount.google.com/linkedapps

  3. If you want to keep managing responses in a spreadsheet, set up the sync again. A new sheet will be created, and future responses will be added there

If you have already stopped the sync as requested in our October 16, 2026 email, please complete steps 2 and 3.

Between stopping the sync and setting it up again, responses will not be added to the spreadsheet. How you receive responses during that time depends on the “Save form responses to Studio.Design” setting in your form settings.

  • If it’s on: responses are saved to your Studio.Design dashboard as usual.

  • If it’s off: responses are sent only to your notification email addresses. Before stopping the sync, make sure a notification destination is set.

Removing access in your Google Account also stops responses from being added to spreadsheets for other projects synced with the same Google Account. For projects where you want to keep using the sync, set it up again in the same way.

For Google Workspace accounts, your organization’s settings may require administrator approval to set up the sync again. If you can’t set it up, please check with your organization’s administrator.

For the steps, see Manage form responses with Google Sheets / Manage form responses: Receive email notifications only.

Are form responses that I didn’t save in Studio.Design affected?

Responses submitted while “Save form responses to Studio.Design” was turned off are not saved in Studio.Design, so they are not included in the information that may have been exposed. We also do not store the contents of the notification emails that tell you about responses.

However, please check the following cases.

  • If you turned it off partway through: Responses that reached the dashboard before then are kept until you remove them with “Delete permanently,” so they are affected.

  • If you sync to Google Sheets: The credentials used to write responses to the spreadsheet may have been exposed. We are asking you to stop the sync, so please see “Q. I use the Google Sheets integration. What should I do?”

For the detailed scope of affected responses, see “Q. Which form responses are affected?”

Am I affected if I embed a form from an external service on my Studio.Design site?

If you embed a form from an external service (such as Google Forms), responses are sent directly from the visitor’s browser to the external service without passing through Studio.Design. Responses received by the external service are not held by Studio.Design, so they are not included in the information that may have been exposed.

However, the embed code you pasted into Studio.Design is included in the information that may have been exposed, as part of your Design Editor content. If the embed code contains values that must not be disclosed, such as API keys or tokens, please replace those values with new ones in the external service.

Embed codes for typical forms contain only information that can also be seen on your published site, such as the form URL.

Which form responses are affected?

Form responses that were saved in Studio.Design are affected. This includes responses saved in Studio.Design even if they are not shown on the dashboard.

Affected responses

  • Responses received on the dashboard

  • Responses moved to Trash (and not removed with “Delete permanently”)

  • Responses submitted as tests from Live Preview

  • Responses whose content could not be displayed on the dashboard because they exceeded your plan’s limit

Responses not affected

  • Responses submitted while “Save form responses to Studio.Design” was turned off (because they are not saved in Studio.Design)

  • Responses removed with “Delete permanently” before September 30, 2026

Even if you turned off “Save form responses to Studio.Design” partway through, responses that reached the dashboard before then remain and are affected.

For attached files, only the file names are included, not the file contents.

If you sync form responses to Google Sheets, the credentials used for the sync may also have been exposed, regardless of your Studio.Design save setting. We are asking you to stop the sync, so please see “Q. I use the Google Sheets integration. What should I do?”

The affected projects are listed in the individual emails we sent on October 16, 2026. If you can’t find the email or aren’t sure whether your projects are affected, please contact us through the inquiry form for the unauthorized access.

How should I notify the people who submitted my forms?

If notification is required and you have contact information such as email addresses, please notify each person individually, for example by email.

If individual notification is difficult, for example because you don't have contact information, you can use an alternative measure instead, such as posting a notice on your website.

We have prepared a template for a notice to post on your website. Please review it and edit it to fit your situation before you use it. You can also adapt the wording for notices you send by email.

View the notification template (in Japanese)

For guidance on determining whether notification is required, please see “Q. (Japan’s Privacy Law) Am I required to notify the people who submitted my form?”

Can Studio.Design notify the people who submitted my forms?

We're sorry for the added burden this places on you, but we're unable to notify the people who submitted your forms directly.

The information submitted through your forms is information that you, as the site operator, have received from the people who submitted it. Studio.Design stores and handles this information on your behalf, as entrusted by you. Under the legal framework as well, notices to the individuals do not come directly from Studio.Design. Instead, Studio.Design, which holds the information on your behalf, first notifies you of the incident, and you then notify the individuals.

In addition, most of the people who submit forms are not aware of Studio.Design. A message from a company they don't recognize would be hard to tell apart from suspicious messages that try to take advantage of this incident. Receiving messages from both you and Studio.Design could also cause confusion.

For these reasons, we ask that any notice to the people who submitted your forms come from you, as the site operator. To support you, we have prepared a notice template and this page, which explains what happened and how we are responding. If the people who submitted your forms have questions about what we have announced, we can answer them through the inquiry form for the unauthorized access.

(Japan's privacy law) Do I need to notify people even for responses that are sales pitches, spam, or raise safety concerns?

You cannot exclude responses from notification based only on the purpose or content of the submission.

If a response contains information that can identify a specific individual, such as a name or email address, notification to that person is generally required. On the other hand, responses that cannot identify a specific individual, such as meaningless strings submitted automatically, may not be subject to notification in the first place.

If notification is difficult, for example because the response contains no contact information or the person cannot be reached, alternative measures such as a public announcement are permitted.

If there are safety concerns, such as a death threat, please consult a lawyer or other expert, or the police, about how and when to notify.

Basis: Guidelines (General Rules) 3-5-4 “Notification to the data subject” (in Japanese)

(Japan's privacy law) Am I required to notify the people who submitted my form?

If personal information you collected through forms is affected by this incident, you may be required under Japan's Act on the Protection of Personal Information to notify the people who submitted the form (data subjects).

Our October 17, 2026 notice (in Japanese) asked you to hold off only on reporting to the Personal Information Protection Commission. Notifying the people who submitted the form (data subjects) is not included in that request.

When considering whether notification is required, please check the following three points.

① Were you using the form for business or organizational activities?

This includes inquiries, reservations, and job applications. Sole proprietors and nonprofit organizations may also be covered.

Basis: General Rules Guidelines 2-5 “Business operator handling personal information” (in Japanese)

Excerpt (unofficial translation): “a person who uses a personal information database, etc. for business”

② Did the form responses contain “personal data”?

Check whether they contain information that can identify an individual, such as names or contact details, including in free-text fields. If responses containing such information are saved on your Studio.Design dashboard, they are generally considered “personal data,” even if you have not created a separate list yourself.

Basis: General Rules Guidelines 2-4 “Personal information database, etc.” and 2-6 “Personal data” (in Japanese)

Excerpt (unofficial translation): “personal information that makes up a personal information database, etc.”

Reference: Managing Form Responses in the Dashboard

③ Could that information be affected by this incident?

Check the affected projects listed in the individual emails we sent you and the information you collected through your forms. Because there is no minimum number of people for breaches caused by acts with a wrongful purpose, if there is a risk of a breach due to unauthorized access, notification may be required even if only one person is affected.

Basis: General Rules Guidelines 3-5-3-1 (3) “Situations subject to reporting” and 3-5-4-1 “Situations subject to notification and the party obligated to notify” (in Japanese)

Excerpt (unofficial translation): “a situation in which a breach, etc. has occurred or is likely to have occurred”

*Each excerpt is part of the original text of the relevant section. This checklist is for reference only. Please decide for yourself whether notification is required, and what and how to notify, based on the laws, the guidelines, and how you use your forms. Consult a lawyer or other expert as needed.

We have prepared a press release template for businesses that you can use for announcements on your own website and elsewhere. Please edit it to suit the information involved and your situation before use. Note that, separately from an announcement on your website, you may be required to notify the people who submitted the form (data subjects). For details, see General Rules Guidelines 3-5-4 “Notification to the data subject” (in Japanese).

View the press release template (in Japanese)

If you have questions about your affected projects or our notices, or if you would like individual guidance, please contact us through the inquiry form for the unauthorized access.

(Japan's privacy law) We collect personal information through our forms. How do we report this to the Personal Information Protection Commission of Japan?

On October 20, 2026, we announced the following on our page for customers who use forms.

Regarding data breach reports to the Personal Information Protection Commission of Japan (PPC), following consultation with the PPC, you can now choose either to report to the PPC yourself individually, or to have Studio.Design compile the reports and submit a joint report in the names of both you and Studio.Design.

■ If you would like to submit a joint report

Studio.Design will compile the reports and submit a joint report in the names of both you and Studio.Design. If you apply using the method we will announce, you do not need to submit an individual report. We will announce how the reports will be compiled and how to apply after consulting with the PPC.

In addition, if you submit a joint report using the method determined in consultation with the PPC, it will not be treated as a late report, for this incident only, even if the standard timeframe for the preliminary report has passed.

■ If you would like to report individually

Regardless of our October 17 request to hold off on reporting, you can report to the PPC yourself.

If you have already reported individually, the PPC has received your report. You can also switch to the joint report. In that case, you do not need to submit a final report individually.

■ What we will announce

We will announce how to apply and the application period as soon as they are decided. If you would like to submit a joint report, please apply at that time.

The joint report covers only the report to the PPC. It does not include notifying the people who submitted the form (data subjects). If notification is required, please continue to consider how you will handle it. For details, see “Q. (Japan's privacy law) Am I required to notify the people who submitted my form?”

For information about your affected projects and this incident, please check the individual emails we sent you. If you can’t find the email or need more information, please contact us through the inquiry form for this incident.

For details and future updates, see “For customers who use forms: Information about reporting to the Personal Information Protection Commission” (in Japanese).

Have my form submissions been exposed?

They may have been exposed. Form submissions we hold may have been read, even where they were stored encrypted, because the key needed to decrypt them was also accessed during the same unauthorized access.

For attached files, only the file names are included, not the file contents.

On October 16, 2026, we sent individual emails listing the affected project names to the owners of projects that use forms.

If you sync form responses to Google Sheets, please also see “Q. I use the Google Sheets integration. What should I do?”

What should I do to prevent unauthorized use of my third-party API keys?

To prevent unauthorized use by a third party, please rotate your keys in the following order.

  1. Issue new keys in each service (such as microCMS or Notion)

  2. Update your Studio.Design settings with the new keys

    – For Data Connect API: in the Design Editor, open the [Connect] panel, open [Authentication] for the API, and update the value with the new key

    – For API Connect (Beta): on the API editing screen, update the key registered in the header with the new key

  3. Revoke the old keys in each service

If you revoke the old keys first, the integration on your site may stop working. If keys for third-party services you no longer use are still registered, we also recommend revoking them in each service.

Please also check the usage history of each service for any activity you don’t recognize since September 30, 2026. If you find any, please let both the service provider and us know through our inquiry form.

For the steps, see Data Connect API (API Integration) / What is API Connect (Beta)?.

Have my API keys been exposed?

Third-party API keys and tokens registered in Data Connect API and API Connect (Beta) settings may have been read, even where they were stored encrypted, because the key needed to decrypt them was also accessed.

I was asked to sign in. Is this normal?

When you sign in, always make sure the URL of the sign-in screen is app.studio.design.

If a screen you opened from a link in an email or message asks you to enter a password or credentials, don’t enter them. Please contact us through the inquiry form instead.

How can I tell whether an email from Studio.Design is genuine?

We send emails from @studio.design or @studio.site addresses, and from the addresses listed in Types of Emails from Studio.Design and How to Unsubscribe.

No email we send about this incident will contain a link that asks you to enter a password or credentials.

If you receive a message claiming to be from Studio.Design from any other address, please contact us through the inquiry form for the unauthorized access.

How do I delete and reissue a Live Preview URL?

We have not confirmed that any issued Live Preview URL has been directly identified. However, depending on the circumstances, the possibility that a URL could be identified and accessed by a third party cannot be entirely ruled out.

If you have issued a Live Preview URL, please delete it as a precaution.
We are also taking measures to make URLs harder to identify.

A deleted URL becomes invalid and can no longer be accessed. If you still need to share a preview, issue a new URL after deleting the old one.

For the steps, see Live Preview.

I use Google or Facebook to sign in. Do I need to do anything?

If you only sign in with Google or Facebook and have not set a Studio.Design password, you don’t need to change your password.

However, if you have ever signed up or signed in to Studio.Design with an email address and password, a password may be set for your account. In that case, reset your password using “Forgot password?” on the sign-in screen. After resetting it, you can continue to sign in with Google or Facebook as before.

Note that if you use Google or Facebook sign-in, the account settings screen shows that you can’t change your password, whether or not a password is set.

I use the same password for other services. What should I do?

We strongly recommend changing your password for any service where you use the same password.

Studio.Design passwords are stored in hashed form, and recovering the original password is difficult, but we cannot completely rule out the possibility. If the password were recovered, a third party could use the same email address and password combination to sign in to other services without authorization.

For how to change the password for each service, see that service’s help pages. Please also change your Studio.Design password.
For the steps, see How to change your password.

Where can I change my password?

See How to change your password.

If you only sign in with Google or Facebook and have not set a Studio.Design password, no action is needed.

I received an email even though I don’t have a Studio.Design account.

We also sent a notice to people who signed up between December 2022 and August 2023 for early access to “Studio AI” (originally named “Auto”), our AI-powered site creation feature. The subject line is “[Important] Notice of exposure of your Studio AI early access registration information.”

The following information we collected at signup may have been exposed:

  • Email address, username, and country of residence (as determined by us from the IP address you connected from when signing up)

We did not collect passwords or payment information at signup, so you don’t need to change any passwords or take other action. Please be alert to suspicious messages that appear to be from us.

If you have any questions, please submit the inquiry form for the unauthorized access.

Which features did you send individual emails about?

On October 16, 2026, we sent a separate email for each of the following features to projects that use them. Each email lists the affected project names and the actions we ask you to take. The subject line of each email begins with “[Important].”

  • API integrations (Data Connect API, API Connect (Beta)): a request to rotate the third-party API keys and tokens you registered

  • Password-protected pages: a request to change the password

  • Forms: information about your form submissions (including a request to stop the Google Sheets sync, if you use it)

  • Custom proxy: a request to replace your custom proxy key

  • Webhook notifications: a recommendation to switch the notification URL

We sent these emails to the owner of each affected project (or to its members if the project has no owner). If you use more than one of these features, you receive a separate email for each.

We have also sent the following emails since then:

  • Custom proxy: an email on October 16, 2026, with additional steps for replacing the key

  • Forms: an email on October 17, 2026, asking you to hold off on reporting to the Personal Information Protection Commission of Japan

If you can’t find the email, please check your spam folder. If you still can’t find it, please contact us through the inquiry form for the unauthorized access.

Has my password been exposed?

Studio.Design passwords are stored in hashed form, not in plain text. Recovering the original password from a hash is difficult, but we cannot completely rule out the possibility, so we ask you to change your password. For the steps, see How to change your password.

How many accounts are affected for each feature?

We are still reviewing the number of affected accounts for each feature. We will share the confirmed numbers as a follow-up on our updates page.

You can check whether your projects are affected in the individual emails we sent for each feature on October 16, 2026. For details, see “Q. Which features did you send individual emails about?” If you can’t find the email, please check your spam folder, then contact us through the inquiry form for the unauthorized access.

What information may have been exposed?

The following information about all registered Studio.Design customers may have been exposed.

  • Studio.Design account information (username, email address, hashed password, etc.)

  • Data you manage on Studio.Design (Design Editor and CMS content, form submissions, Google reCAPTCHA v3 settings, Webhook notification URLs)

  • Live Preview URLs used to view pages before they are published

  • Credentials stored in various settings (third-party API keys and tokens registered in API integrations, passwords for password-protected pages, Google Sheets integration credentials, custom proxy keys)

Form submissions, third-party API keys and tokens, Google Sheets integration credentials, custom proxy keys, Google reCAPTCHA v3 settings, and Webhook notification URLs may have been read, even where they were stored encrypted, because the key needed to decrypt them was also accessed during the same unauthorized access.

Will Studio.Design sign everyone out?

At around 2:30 AM on October 14, 2026 (JST), we signed out all customers who were signed in to Studio.Design as a precaution. The first time you open Studio.Design after that, you need to sign in again.

When do you expect to complete the root-cause investigation and the measures to prevent a recurrence?

We have fixed the vulnerability used for the unauthorized access and closed the entry point.

We are arranging for an outside specialist firm to conduct a detailed investigation of the cause. We have not yet determined when the results and the measures to prevent a recurrence will be ready. We will share them as a follow-up on our updates page once they are confirmed.

Has Studio.Design finished replacing its keys and credentials?

We have replaced the credentials we used to handle customer information, including those used for payments and sign-in. We also rotated the encryption key used to protect information such as form submissions and third-party API keys on October 17, 2026. Data saved since then is encrypted with the new key.

We keep the old key only to read data saved before the change, and we do not use it for newly saved data. We are now re-encrypting that data with the new key so that we can retire the old key.

However, replacing our keys and credentials does not protect information that may already have been obtained during the unauthorized access. Also, third-party API keys and tokens are managed by the services that issued them, so we cannot revoke them on our side. Please switch to new keys and revoke the old ones yourself. For custom proxy keys, we have already issued new keys. For the steps, see “Feature-specific guidance” (in Japanese).

Could the third party modify data, not just view it?

The credentials obtained by the third party included permission to modify data.

These credentials have already been revoked, and the entry point used for the unauthorized access has been closed.

We reviewed the activity records for these credentials and found no record of customer data, such as Design Editor or CMS content, being modified or deleted. We will continue to check the data, including through an investigation by an outside specialist firm. We will share any new findings as a follow-up on our updates page.

If you notice any changes you don’t recognize, please contact us through the inquiry form for the unauthorized access.

Has any data tampering, deletion, or secondary harm been found?

At this time, no tampering with or deletion of data has been found. If you notice any changes you don’t recognize, please contact us through the inquiry form for the unauthorized access.

We are investigating whether any secondary harm related to this incident, such as unauthorized sign-ins or misuse of information, has occurred. We will share the results as a follow-up on our updates page. Depending on the results, we may also contact you individually.

Is the unauthorized access still ongoing?

At this time, we have not found that the unauthorized access is ongoing.

The period of unauthorized access confirmed so far is September 30 – October 1, 2026 (JST). We have fixed the vulnerability that caused it and closed the entry point used for the unauthorized access.

For the status of our key and credential replacement, see “Q. Has Studio.Design finished replacing its keys and credentials?”

What happened?

An unauthorized third party accessed the cloud environment used by Studio.Design, and information we hold may have been exposed.

Between September 30 and October 1, 2026, a third party exploited a vulnerability in a Studio.Design feature to gain unauthorized access and made data in our environment accessible from outside our systems. The data remained accessible until we closed off that access on October 14, 2026. We have not confirmed that the data was actually retrieved by the third party, but we are proceeding on the assumption that it was.

  • September 30 – October 1, 2026 (JST): unauthorized access by a third party (the period confirmed so far)

  • October 13, 2026: our internal investigation confirmed the unauthorized access

  • October 13–14, 2026: we fixed the vulnerability and closed the entry point used for the unauthorized access, and we blocked external access to the data

We will share the results of our root-cause investigation and the measures to prevent a recurrence as a follow-up on our updates page once they are confirmed.

The operator of a site built with Studio.Design told me that my form submission may have been exposed.

Content submitted through forms on sites built with Studio.Design is collected and managed by each site’s operator for their own purposes. We store the submissions and handle related processing on behalf of the operators.

How your submission is handled and what the site does next are decided and handled by each site’s operator. Please contact the operator of the site that sent you the notice. We handle this information on behalf of the site operator and therefore cannot provide details about individual form submissions.

For what we have announced, such as how this happened and the types of information that may have been exposed, please check the FAQ on this portal first. If you still need to contact us, submit the inquiry form for the unauthorized access.
Please be alert to suspicious messages that try to take advantage of this incident. For details, see “Q. How can I tell whether an email from Studio.Design is genuine?”

Who should I contact if I received a notice from a site operator?

For questions about what you submitted or how that site is handling it, please contact the operator of the site that sent you the notice.
For questions about what we have announced, please check the FAQ on this portal first. If you still need to contact us, submit the inquiry form for the unauthorized access.

Contact us

For feature related questions, please use the in-app chat.

To report abuse, please submit the form here.

Name

Email

Message

Pricing

Updates

Learn

Discord

Templates

Terms

FOLLOW US

X（Twitter）InstagramYouTubeLinkedin

Features

Design Editor

CMS

Hosting

Forms

SEO

Figma to STUDIO

Lottie