Studio Inc. disclosed on Oct 16 that an attacker abused a vulnerability in part of the Studio platform to reach its cloud environment between Sep 30 and Oct 1 (JST, the window confirmed so far) and left its data readable from outside until Studio fixed it on Oct 13–14. Studio says it hasn't confirmed actual retrieval but is treating everything as taken. For all registered customers that covers account data (username, email, hashed password), design-editor and CMS content, saved form submissions (including trashed and test responses), reCAPTCHA v3 settings, webhook URLs, live-preview URLs, and credentials held in settings: external API keys and tokens from API integrations, password-protected page passwords, Google Sheets integration credentials and custom-proxy keys. Encrypted fields are included because the decryption key was read in the same intrusion. Studio rotated the Google Sheets connection key on Oct 14, is issuing new proxy keys, and asks customers to change passwords, delete live-preview URLs, rotate any API keys stored in Studio and re-link Google Sheets. On Oct 17 Japan's Personal Information Protection Commission asked form customers to hold their own breach reports while Studio negotiates a joint filing; notifying site visitors is still on each customer. Record counts are promised in a later update.