The team behind MAPPA EXPO 15th Anniversary, the exhibition celebrating 15 years of anime studio MAPPA, has issued an apology after a security breach at an outside service. In a notice posted to the expo's official X account today (October 17th), the event office said that names, email addresses, and messages fans sent through the official site's contact form may have been leaked. The breach happened at STUDIO, the cloud-based website builder used to run the expo site.
The office said it is sorry for the worry and trouble this has caused and laid out what it knows so far. You can read the full notice down below:
What Information May Have Leaked
According to the notice, Studio Inc., the company that runs STUDIO, informed the expo office yesterday (October 16th) that a third party had gained unauthorized access to the cloud environment it uses. Any information sent through the expo site's CONTACT form and stored on that service may have been exposed.
The affected window covers messages submitted between June 19th and October 15th of this year. The information involved is limited to the name, email address, and the content of each inquiry. The expo office says it is still working out exactly how many people are affected, and at this point there is no confirmation that any third party actually obtained the data. Studio Inc. has said it is treating the data as if it was taken, and the expo office is working under the same assumption while it checks the details with the company.
The office also stressed that the problem is limited to the expo website. No misuse of the information or other secondary damage has been confirmed, and there is no sign of unauthorized access to the main MAPPA website or the MAPPA ONLINE SHOP.
How The STUDIO Breach Happened
Studio Inc. posted its own first report on the incident yesterday (October 16th). The company says a third party exploited a vulnerability in some of STUDIO's features to access its cloud environment and leave the data inside open to being pulled from outside. Based on its investigation so far, the unauthorized access took place from September 30th to October 1st Japan time. The company found it during an internal investigation on October 13th, then fixed the vulnerability and closed off the route the attacker used over October 13th and 14th.
The breach was not limited to MAPPA. Studio Inc. says data tied to every registered STUDIO customer may have been exposed, including account details, the content of sites built with the service, and anything submitted through forms on those sites. It has asked customers to change their passwords, and site owners who use STUDIO's form feature have been told they may need to notify the people who filled those forms out. The company has also said it is working with Japan's Personal Information Protection Commission and outside experts.
What Fans Should Watch Out For
If you sent a message through the expo site's contact form over the summer, the main thing to look out for is phishing. The expo office warned that fake emails pretending to come from the event or from Studio Inc. may start showing up. It asked fans not to click links, open attachments, or enter personal details from any suspicious email they were not expecting. The office says it will contact affected fans individually if needed, and it will post any updates through the official site and social accounts. Questions about the incident should go to the expo office's dedicated email address, which is listed in the notice.
A Rough Week For A Big Anniversary
MAPPA EXPO 15th Anniversary opened last month (September 16th) at the Yurakucho Museum in Tokyo, and it is still running. The exhibition covers works MAPPA has produced since it was founded in 2011, including Chainsaw Man - The Movie: Reze Arc, Attack on Titan The Final Season, and Jujutsu Kaisen, with original drawings, layouts, and designs on display. Interest has been strong, with the expo account regularly posting sold-out goods updates and no same-day tickets this weekend. A MAPPA 15th Anniversary Layout Book is also set to go on sale at the Tokyo venue later this month (October 28th).
The breach notice went out on the same day MAPPA took first place in the Studio award at the Newtype Anime Awards, where readers of the magazine voted it the top anime studio of the past year.
Do you think companies like MAPPA should stop relying on outside website builders for big events, or is this the kind of risk that comes with running anything online?
Let us know your thoughts in the comments below.