Japan’s Digital Agency Says Vendor Breach May Expose 13,000 Entries

Japan’s Digital Agency, the government body in charge of the country’s digital transformation, says personal data people submitted through its website may have been exposed. The cause was a breach at Studio Co., whose website-building service the agency used to run part of its site. In a notice published on 22 October, the agency listed up to 13,323 contact-form entries made between May 2021 and March 2023, plus 35 staff and contractor accounts.

The data mostly consists of names and email addresses, but some entries include phone numbers and delivery addresses. The agency says it has not confirmed any misuse. Studio says it found the unauthorised access on 13 October, fixed the flaw within a day and went public three days later.

What the Digital Agency says was exposed

The agency says Studio told it on 16 October that a third party had accessed Studio’s cloud environment without authorisation and had made the data inside retrievable from outside. The agency, and before it the Digital Reform Legislation Preparation Office that prepared its launch, had used Studio’s service to run part of the agency’s website.

The notice gives a maximum figure for each form, and the agency says the scope is still being checked:

For the first four forms, names, email addresses and similar details were only included if people chose to give them. The Japan Times reported that Digital Minister Toshiharu Furukawa confirmed the breach at a news conference on Friday 23 October, and gave the total as “more than 13,000 user profiles”.

The agency says no secondary harm, such as misuse of the data, has been confirmed. It warns people to watch for suspicious emails, calls and texts that pretend to come from the agency or related bodies. It adds that it “will never ask for authentication information such as passwords, or personal information such as credit card details, by email or phone” (translated).

How Studio says the breach happened and what it has done

Studio’s own notice, first published on 16 October and updated on 18 October, says a third party exploited a vulnerability in some of its features to get into its cloud environment. The data stayed retrievable from outside until Studio dealt with the problem on 14 October. The company says it has not confirmed that any data was actually taken but is treating it as taken.

Studio’s timeline runs as follows:

• 30 September to 1 October: the unauthorised access took place, in the period confirmed so far.
• 13 October: an internal investigation found the access.
• 13 to 14 October: Studio fixed the vulnerability and closed the route.
• 16 October: Studio published its notice.

Studio says data belonging to all its registered customers may have been exposed. Form contents and stored credentials that had been encrypted may also be readable, because the keys needed to decrypt them were read in the same access. Passwords were stored only in hashed form. Form responses held on Studio are in scope. Responses sent while the setting that saves results to Studio was switched off are excluded, as are responses fully deleted before 30 September.

In response, Studio says it has replaced the credentials it uses to handle customer data, including those for payments and login. It switched to a new encryption key on 17 October and is re-encrypting older data. The credentials the outsider obtained included permission to change data. Studio says those credentials have been cancelled and its logs show no customer data was rewritten or deleted. It says it is handling its reporting to the Personal Information Protection Commission (PPC), Japan’s data protection regulator, and other relevant bodies, and is arranging an investigation into the cause by outside specialists. On 17 October it published guidance for form users on reporting to the PPC.

The Japan Times reported that the agency had cited its own investigation process as the reason it took until 22 October to disclose the breach. The paper also reported that a separate incident, revealed on 11 September, exposed government employees’ names and email addresses through the Government Solution Service network. TSN has tracked other Japanese incidents that came through third parties, including NEC’s contractor breach, Nikkei’s development-cloud leak and this month’s wider wave of disclosures.

Contact-form entries from 2021 were still exposed in 2026

The agency’s own list shows how long the data had been stored. The newest of the affected form entries date from March 2023, and the oldest from May 2021. Yet they were still held on a supplier’s platform when that platform was accessed in late September 2026, more than three years after the last of them came in. Several of the forms dealt with one-off matters: enquiries about the vaccination certificate app, requests to borrow a mascot costume, and sign-ups for workshops.

Studio’s notice explains why that mattered. Responses that had been fully deleted before 30 September were outside the breach, and so were responses sent while saving to Studio was switched off. Under Studio’s own rules, entries the agency no longer needed would not have been exposed if they had been fully deleted before the access. That is a retention question for the data owner, not the vendor. Studio’s 17 October guidance on PPC reporting for form users points the same way: the organisations that collected the data, including the agency, have their own reporting to handle. Any public body that collects personal data through a third-party site builder can check the same setting and the same backlog.

Studio disclosed in three days and the agency in six more

Studio’s response was fast and detailed. It found the access on 13 October, closed the route by 14 October and published a full account on 16 October. That account covered the data in scope, the encryption-key problem, replacement credentials, a log review showing no data was changed, and what customers should do. It reported to the PPC and brought in outside specialists. The agency’s notice then broke the exposure down form by form, which lets people work out whether they are likely to be affected.

The gap sits between those two steps. Studio told the agency on 16 October, but the agency did not publish until 22 October, six days later. According to The Japan Times, the agency cited its own investigation process as the reason. During those six days, Studio’s public notice already said form data might have leaked, but people who had contacted the agency had no way to know their entries were involved. The agency’s warning about fake messages is sound. It would have helped more if it had come out closer to Studio’s own disclosure, especially from a body that, as The Japan Times noted, offers the government guidance on cybersecurity.

What happens next

Both organisations say their figures are provisional. The agency is still confirming the scope. Studio has promised updates on the number of customers affected, whether any secondary harm has occurred, and the cause and steps to stop a repeat. The agency’s written summary of Furukawa’s news conference, which its website says will be posted later, should show whether the government is reviewing how long it keeps data on suppliers’ platforms.

Sources

• Studio 株式会社における不正アクセスによる個人情報の漏えいの可能性について (possible leak of personal information due to unauthorised access at Studio Co.), Digital Agency, 22 October 2026
• 【重要】不正アクセスによる情報流出に関するお詫びとお願い（第一報） (apology and request regarding information leak due to unauthorised access, first report), Studio Co., 16 October 2026, updated 18 October 2026
• Digital Agency reports data breach via website vendor, The Japan Times, 23 October 2026

Related stories

• NEC Says Hackers Used a Contractor’s Accounts to Encrypt Customers’ Servers
• Nikkei Says 1.83 Million Personal Data Items Leaked From a Development Cloud
• Japan’s Data-Breach Wave: What Bookoff, Times Car, skyticket, Lawson, Resorttrust and Others Have Admitted
• Cyber Breaches: SoftBank Cloud Ransomware, Qilin’s 53 Japanese Victims, Asos’s Bigger Leak and Denmark’s Register