After the STUDIO breach: moving your site to WordPress you host yourself

Published 2026-11-10

Four weeks after STUDIO said someone had been inside its cloud environment, the clean-up is still going on, and many of the organisations caught up in it are asking whether their website should live on a hosted builder at all. This post gathers what Japanese news has reported, what to do before anything else, and how FrontierStack's new STUDIO import moves a site to a WordPress site you run yourself.

What happened

On 16 October 2026, STUDIO (studio.design), the no-code website builder widely used in Japan, published a notice of unauthorized access (there is also an English version). A third party exploited a vulnerability in one of STUDIO's features and could reach data in its cloud environment between 30 September and 1 October (JST). STUDIO found the access on 13 October and closed the route on 13–14 October. It says the data of every registered customer may have been exposed, and it is acting as if the data was taken. Nikkei reported the same day that the service is used by more than 30,000 companies.

The detail that matters most came out afterwards. Form submissions and the API keys customers had saved were stored encrypted, but the key needed to decrypt them was read too, as ScanNetSecurity reported. The effects reached well beyond STUDIO's own customers: on 22 October Japan's Digital Agency announced that inquiries sent through a contact form on its STUDIO-built pages may have leaked (ScanNetSecurity), and by 27 October the security blog piyolog had listed 192 organisations that had announced they were affected or were investigating.

First the keys, then the move

Moving away undoes nothing that has already been copied. If you saved API keys or tokens in STUDIO; for microCMS, OpenAI, Google Sheets or anything else connected through Data Connect or API Connect; rotate them at each vendor first, and check each vendor's usage and logs from 30 September. Our Leak News entry for STUDIO lists all ten steps STUDIO asks customers to take, and When your website builder holds your API keys explains why changing your STUDIO password doesn't protect them.

If your forms collected personal data, STUDIO's notice also explains how to report to Japan's Personal Information Protection Commission, on your own or jointly with STUDIO. Applications for the joint report close at 23:59 JST on 18 November.

Why self-host?

A hosted builder is convenient because someone else holds everything: the pages, the form submissions and the keys to every service the site talks to. This breach showed the other side of that convenience. Thousands of unrelated sites shared one environment and one decryption key, and their owners learned what had happened from a notice. Running the site yourself puts those things on a server you choose, with backups you hold, logs you can read and keys that live in one place you know about.

It is not automatically safer. You take on updates, backups, certificates and the server's own security, and a neglected WordPress site is a target too. For a small brochure site whose keys you have rotated, staying on STUDIO can be the sensible choice. Self-hosting suits you if you already run servers or have someone who does, if your site handles enquiries or personal data you would rather keep yourself, or if you simply want your content in a form you can take anywhere.

STUDIO has no export, so FrontierStack reads the site

STUDIO offers no way to download a site and no public API for its content. The latest FrontierStack update adds Import from STUDIO under Migrate Setups ▸ Site Builders. You type the site's address; FrontierStack reads what the site shows every visitor, with no STUDIO sign-in or API key, and builds a WordPress site from it on your Mac.

• Pages: text, headings, lists, links and images. The STUDIO home page becomes the front page.
• CMS items become posts, with their publish dates and cover images, and the items they link to as categories and tags.
• Images go into the WordPress media library. YouTube and Vimeo embeds are kept.
• Old addresses redirect to the new pages, so existing links and search results keep working once the domain moves.
• A new site: FrontierStack downloads WordPress, creates a database with its own MySQL user, adds an Apache site for it and installs WordPress, all in the same step. You can also choose a WordPress site you already have in the WordPress pane.

Some things can't be copied, and the import ends with a checklist of them: the design and layout, animations, headers, footers and menus shared between pages, background images, embeds other than video, and fonts (web fonts STUDIO provides, such as TypeSquare and FONTPLUS, come with STUDIO). Forms have to be rebuilt with a form plugin. Those forms are what collected the data in this breach, so it is worth deciding now where new submissions will be stored and who can read them.

Newer STUDIO sites send finished pages, and the import reads those. Older ones send an empty page that the browser fills in; for those, FrontierStack reads the page layouts from STUDIO's publish storage and the CMS items from STUDIO's CMS service, the same requests a visitor's browser makes. Use it on your own site.

From your Mac to a host

When the new site looks right on your Mac, Publish to a Host… opens Site Clone ready to copy the site and its database to a server you run or a hosting account. The copy gets a wp-config.php with its own database login there, set to answer at your existing address. Keep the STUDIO site running until the new one is live, then point your domain at it; the redirects take care of the old addresses.

Pancake Stack, our Mac App Store app, has the same import under New Site ▸ From STUDIO.

A checklist for the move

1. Rotate every key you saved in STUDIO, and check each vendor's logs from 30 September.
2. Import the site and work through the checklist the import gives you.
3. Rebuild your forms, and decide where submissions are stored and who can read them.
4. Set up backups and updates before the site goes live, not after.
5. Publish to your host and test it there at a temporary address.
6. Point your domain at the new site, then close the STUDIO project once the old addresses redirect.

Sources

• Studio: Studioにおける不正アクセスに関するご案内 (Japanese; updated to 4 November 2026) and the English notice
• Nikkei, 16 October 2026: Web制作ツールのStudioに不正アクセス　顧客情報流出か (Japanese; partly paywalled)
• ScanNetSecurity, 28 October 2026: Studio が利用するクラウド環境に不正アクセス、復号に必要な鍵も読み出される (Japanese)
• ScanNetSecurity, 28 October 2026: デジタル庁ホームページの問い合せフォームの情報が漏えい、Studio のクラウド環境への不正アクセス (Japanese)
• piyolog, 20 October 2026, updated 27 October: Studioへの不正アクセスについてまとめてみた (Japanese)
• FrontierStack Leak News: STUDIO unauthorized access (October 2026)