Thank you for using Studio.Design.

We are writing to inform you that an unauthorized third party gained access to the cloud environment used by Studio.Design, and that customer information we hold may have been exposed.

We sincerely apologize for the concern and inconvenience this may cause.

To help prevent further harm, this notice first describes what we know at this time and the actions we ask you to take. We will update this page with further information as our investigation progresses.

Please review “3. What we ask of all customers” and take the actions that apply to you. Customers using certain features, such as API integrations, password-protected pages, forms, or custom proxy, will also receive separate emails with specific instructions (see “4. If you use certain features”).

1. What happened

A third party exploited a vulnerability in a Studio.Design feature to gain unauthorized access to our cloud environment and made data in that environment accessible from outside our systems. The data remained accessible until we closed off that access on October 14, 2026. We have not confirmed that the data was actually retrieved by the third party, but we are proceeding on the assumption that it was. The vulnerability has been fixed, and the entry point used for the unauthorized access has been closed.

• September 30 – October 1, 2026 (JST): unauthorized access by a third party (the period confirmed so far)

• October 13, 2026: our internal investigation confirmed the unauthorized access

• October 13–14, 2026: we fixed the vulnerability and closed the entry point used for the unauthorized access, and we blocked external access to the data

• October 16, 2026: this notice was published

2. Information that may have been exposed

Based on our investigation so far, the following information about all registered Studio.Design customers may have been exposed. We will report the number of affected customers in a follow-up once we have confirmed it.

• Studio.Design account information (username, email address, hashed password, etc.)

• Data you manage on Studio.Design (Design Editor and CMS content, form submissions, Google reCAPTCHA v3 settings, webhook notification URLs)

• Live Preview URLs used to view pages before they are published

• Credentials stored in various settings (third-party API keys and tokens registered in API integrations, passwords for password-protected pages, Google Sheets integration credentials, custom proxy keys)

Form submissions, third-party API keys and tokens, Google Sheets integration credentials, custom proxy keys, Google reCAPTCHA v3 settings, and webhook notification URLs may have been read, even where they were stored encrypted, because the key needed to decrypt them was also accessed during the same unauthorized access.

Studio.Design passwords and the passwords for password-protected pages are stored as hashes, not in plain text. Recovering the original password from a hash is difficult, but we cannot completely rule out the possibility, so we ask you to change your passwords.

We are investigating whether any further harm, such as unauthorized sign-ins or misuse of information, has occurred. Because the credentials that may have been exposed could be misused, we ask you to take the actions in sections 3 and 4.

If you have submitted information through a form on a site built with Studio.Design, you may receive a notice from the operator of that site. You can also contact us through “7. Contact” if you have questions.

In addition, for people who signed up between December 2022 and August 2023 for early access to “Studio AI” (originally named “Auto”), our AI-powered site creation feature, the following information we collected at signup may also have been exposed. Some of these people do not have a Studio.Design account. We will contact everyone affected individually.

• Email address, username, and country of residence (as determined by us from the IP address they connected from when signing up)

3. What we ask of all customers

(1) Change your Studio.Design password

If you sign in to Studio.Design with an email address and password, please change your password. If you use the same password for other services, we strongly recommend changing those as well. If you only sign in with Google or Facebook and have not set a Studio.Design password, no action is needed.

How to change it: How to change your password | Studio Help

(2) Delete and reissue Live Preview URLs

If you have issued a Live Preview URL, please delete it. We have not confirmed that any issued Live Preview URL has been directly identified. However, the possibility of unauthorized access cannot be entirely ruled out, so we recommend deleting any issued Live Preview URLs as a precaution. A deleted URL becomes invalid and can no longer be accessed. If you still need to share a preview, issue a new URL after deleting the old one.

How to delete it: Live Preview | Studio Help

(3) Be alert to suspicious messages that appear to be from us

Phishing emails or messages pretending to be from Studio.Design may be sent in connection with this incident. Do not open links or attachments you do not recognize. We will never ask for your password or credentials by email or phone, and no email we send about this incident will contain a link that asks you to enter them.

4. If you use certain features

If you use any of the following features, we are sending you a separate email with the specific actions or checks we ask of you. These emails are sent to the owner of each affected project.

• API integrations (Data Connect API, API Connect (Beta)) with third-party API keys or tokens registered: rotate the keys

• Password-protected pages: change the password

• Forms: information about your form submissions; if your responses are connected to Google Sheets, a request to disconnect the integration

• Custom proxy: switch to a new proxy key

• Webhook notifications: switch the notification URL

If you have not received an email or have questions, please contact us through “7. Contact.”

5. What we are doing

• We have fixed the vulnerability and closed the entry point used for the unauthorized access. We are investigating the cause and identifying the full scope of the impact.

• We have replaced the credentials our systems use for payments and sign-in. We are in the process of revoking and replacing the remaining credentials.

• At this time, no tampering with or deletion of data has been found.

• We are reporting this incident to the Personal Information Protection Commission of Japan and will continue to work with other relevant authorities.

• We are working with outside experts to prevent a recurrence.

6. What we will report next

We will update this page as soon as we have confirmed the following:

• The scope and number of affected customers

• The results of our investigation into any misuse of the exposed information

• The results of our root-cause investigation and the measures to prevent a recurrence

7. Contact

If you have questions or requests about this incident, please contact us in one of the following ways:

• If you can sign in to Studio.Design
  Open the Support Center from the help icon at the bottom left or right of the screen, go to “Messages” > “Send us a message,” and select “Inquiry about the unauthorized access.”

• If you can't sign in, or you only manage billing for the account
  Submit the inquiry form for the unauthorized access.

Both channels are open 24 hours a day. We reply in the order received, on weekdays from 10:00 to 18:00 JST. Please note that responses may take longer when we receive a high volume of inquiries.

Again, we sincerely apologize for the concern and inconvenience this incident has caused.

Studio, Inc.

Update history

• October 16, 2026: First report published