2026 Japan Digital Agency — website vendor Studio breach exposed 2021–2023 inquiry-form data; up to 13,000 people
Data compromised
Names, email addresses and the contents of messages sent through the agency’s online inquiry forms between May 2021 and March 2023. Up to 8,833 general opinions and requests, and up to 3,661 questions about the vaccination certificate app. Reporting says more than 13,000 profiles may be involved; the breakdown totals about 12,494.
Technical writeup
The agency acknowledged the breach late on October 22, 2026 (TV Asahi, as reported by TokyoReporter). Reporting says the breach was not publicly reported until October 16, and the agency cited its own investigation process for the delay. No secondary misuse has been confirmed; the agency warns about spoofed emails, calls and texts. This is a downstream victim of studio-japan-cloud2026. It is separate from the September 2026 VPN-flaw breach at the agency (japan-digital-agency-gss2026). recordsAffected is the upper figure reported.
Root cause
A third party gained unauthorised access to the cloud environment of Studio Inc., the website-building vendor that runs parts of the agency’s website. Studio says the intrusion took place between September 30 and October 1, 2026, confirmed it on October 13 and disclosed it on October 16.