Japan Digital Agency flags possible data leak after Studio breach
The Digital Agency says up to 8,833 general comments and up to 3,661 inquiries about its vaccination certificate app may have been exposed.
The Digital Agency announced on October 22, 2026, that personal information may have leaked after a third party gained unauthorized access to Studio Inc., a vendor used in part of its website operations, according to internet.watch.impress.co.jp.
The agency said it received a report from Studio on October 16 that unauthorized access to a cloud environment had been confirmed and that data was in a state where it could be obtained from outside.
The scope of the possible exposure is still being examined. The agency listed up to 8,833 general opinions and requests, up to 250 recruitment-related inquiries, up to 3,661 inquiries about its vaccination certificate app, up to 117 inquiries about borrowing the mascot costume of its public relations character, up to 462 items related to workshop and other participation, and 35 Studio account records.
No secondary harm, such as misuse of personal information, has been confirmed as of now, the agency said.
It urged people to be cautious of suspicious emails, phone calls and SMS messages, and not to open links or attached files in messages they do not recognise. The agency also said it never asks for personal information such as passwords or credit card details by email or phone.
Earlier breach timeline
Studio confirmed the unauthorized access through an internal investigation on October 13, fixed the vulnerability and closed the route used for the intrusion on October 14, and issued its first report on the information leak on October 16, according to the agency's account.
Quick answers
What personal information may have been leaked in the Digital Agency breach?
The agency says the scope is still being examined, but lists up to 8,833 general opinions and requests, up to 3,661 inquiries about its vaccination certificate app, up to 250 recruitment-related inquiries, up to 462 workshop participation items, up to 117 mascot costume borrowing inquiries and 35 Studio account records.
Has any misuse of the data been confirmed?
The Digital Agency said no secondary harm, such as misuse of personal information, has been confirmed as of now.
What should people do after the Digital Agency data leak?
The agency urged caution over suspicious emails, phone calls and SMS messages and said people should not open links or attachments in messages they do not recognise.