October 22, 2026: Japan's Digital Agency acknowledged that personal data sent through its online inquiry forms was exposed when its website vendor, Studio Inc., was breached. The data covers submissions from May 2021 to March 2023 and includes names, email addresses and message contents. Reporting puts the upper figure at about 13,000 people. Canonical: japan-digital-agency-studio2026. Primary source: Studio's notice of the unauthorised access, with Japan Times coverage.
The Digital Agency runs parts of the government's digital services. Some of its web pages and inquiry forms are built and run by an outside vendor, and that is where this breach started. The agency is the victim here, but the people who wrote to it are the ones carrying the risk, because a message to a government office often contains exactly the kind of personal detail a scammer wants.
What happened
- September 30 – October 1, 2026: a third party gained unauthorised access to Studio's cloud environment, according to Studio.
- October 13, 2026: Studio confirmed the intrusion.
- October 16, 2026: Studio disclosed the breach publicly.
- October 22, 2026: the agency acknowledged the breach late that day, as reported by TV Asahi and carried by TokyoReporter.
Reporting says the breach was not publicly reported until October 16, and that the agency cited its own investigation process for the timing. That account comes from press coverage, not from a statement the agency published directly.
What data was taken
- General opinions and requests: up to 8,833 people.
- Questions about the vaccination certificate app: up to 3,661 people.
- Total: the breakdown adds to about 12,494, and reporting says more than 13,000 profiles may be involved. The catalog uses the upper figure of 13,000.
The exposed fields are names, email addresses and the contents of the messages. The message contents are the sensitive part, since they can reveal personal circumstances, health questions and the reasons someone contacted the government.
Technical analysis
Studio runs part of the agency's website, so this is a supply-chain incident: the agency's own systems were not described as compromised, and the data came from the vendor's cloud environment. Studio's notice describes the unauthorised access to its cloud environment and does not describe the method in detail. The catalog treats this incident as a downstream victim of the Studio breach, which is recorded separately.
This incident is separate from the September 2026 VPN flaw at the agency, which is recorded in japan-digital-agency-gss2026. Readers should not treat the two as one event.
Verified vs unverified
- Verified (Studio notice and agency acknowledgment, as reported): the unauthorised access, the May 2021 to March 2023 period, the data categories, and the dates Studio confirmed and disclosed the breach.
- Reported but not independently confirmed: the upper figure of about 13,000 people, and the agency's explanation for the timing of its acknowledgment.
- Not known: who carried out the intrusion, whether any data has been published or sold, and whether any affected person has been targeted.
Who is at risk
Anyone who sent an inquiry through the agency's forms between May 2021 and March 2023 is in scope, including people who asked about the vaccination certificate app. The risk is highest for people whose messages contain identifying details, such as a name, a location or a case number. Email addresses in the set can also be used for spoofed messages that appear to come from a government office.
What to do
- Expect messages that quote a form you sent. Scammers use real details from leaks, so a message that mentions your question is not proof that it is genuine.
- Do not click links in unexpected emails, calls or texts that claim to come from a government office. Type the official address yourself.
- Do not give ID numbers, passwords or card details in reply to an unsolicited request, even one that looks official.
- If you want to know whether your submission is in the affected set, ask the agency through its official contact channels. The agency is the only party that can check its own records.
- Use a unique password for any account that uses the same email address that you used with the agency, and turn on two-factor authentication where it is offered.
Open questions
The agency has not published a full account of what the 2021 to 2023 submissions contained beyond the categories above, and reporting does not say whether any individual submission was singled out. The upper figure may fall or rise as the counts are checked. Readers who want a firm answer about their own submission should ask the agency directly.
Related reading
For another Japanese case where personal email addresses were exposed and phishing was the main concern, see the Tokyo Metro email exposure. The same advice applies: a leaked address is the start of a phishing campaign, not the end of it.