MAPPA EXPO warns contact-form data may have been exposed in STUDIO breach
MAPPA EXPO says contact-form details may have been exposed after a vulnerability was exploited at the STUDIO cloud platform.
MAPPA EXPO says names, email addresses and messages submitted through its contact form may have been exposed after a breach at STUDIO, the cloud website platform used to run the exhibition site. The event office says there is no confirmation that an outside party actually obtained the information, but it is treating the data as potentially compromised while the investigation continues.12
What may have been exposed
The possible exposure covers messages sent through the MAPPA EXPO site between 19 June and 15 October 2026. The information involved is limited to names, email addresses and the contents of contact-form enquiries, according to the event office's notice.2 MAPPA's main website and online shop are not currently believed to be affected.
STUDIO says an unauthorised party accessed its cloud environment after exploiting a vulnerability in some of its features. The company says the access took place between 30 September and 1 October, was found during an internal investigation on 13 October, and was closed off after fixes were completed on 13 and 14 October.1
The wider STUDIO incident may affect more than the exhibition. STUDIO's own notice says information linked to registered customers and data stored through some of its services may have been exposed. It has reported the incident to Japan's Personal Information Protection Commission and is continuing to investigate the scope.1
What visitors should do
MAPPA EXPO is warning people who contacted the event to be alert for phishing emails pretending to come from the exhibition or STUDIO. The office says visitors should not open unexpected attachments, follow suspicious links or enter personal information in response to an unverified message.2 Anyone with concerns is being directed to the event office's published contact address.
The breach notice does not say that the stolen information has been misused, and the number of potentially affected people is still being checked. That distinction matters: possible exposure is not the same as confirmed theft, but treating the data as compromised is the sensible precaution while STUDIO and the event office establish what happened.
Our opinion
This is exactly the sort of incident that makes a clear, timely warning more useful than vague reassurance. MAPPA EXPO has identified the affected form, the date range and the kind of information involved, while STUDIO has described the vulnerability and the fix. Visitors should still be cautious, but they should not assume that every message claiming to be connected to the event is genuine. The next important update will be a clearer account of how many records were exposed and whether anyone accessed them.