2026 Studio (JP) — cloud vuln; all registrants possibly exposed (no census)
Data compromised
All Studio registrants possibly: username, email, hashed password; editor/CMS content; form submissions; live-preview URLs; API keys/tokens, page-protection passwords, Sheets OAuth, proxy keys, reCAPTCHA settings, webhook URLs (encryption keys also readable). Studio AI waitlist 2022-12–2023-08: email/username/country. Count TBA. recordsAffected 0.
Technical writeup
Verified Studio Inc. first report 16 Oct 2026 (form-PPC follow-up 17 Oct). Actual take unproven; company treating as leaked. companyConfirmed true; recordsAffected 0.
Root cause
Vulnerability in a Studio feature let a third party into the cloud environment (confirmed window 30 Sep–1 Oct JST). Data remained retrievable until patched/blocked 13–14 Oct. Treat as taken even though exfil not proven. Downstream form operators (e.g. Rakusuru, Link-U, Kufu group) issuing their own notices.