Gyazo breach: 23.6M user records and 490M image-metadata records — and why the metadata is the sharper harm

Executive Summary

On September 11, 2026, a third party exploited a vulnerability in the image-upload server of Gyazo — the cloud screenshot and screen-recording service operated by Kyoto-based Helpfeel Inc. — to gain unauthorized access to Gyazo's systems and execute arbitrary commands.¹ Helpfeel detected the activity that evening, blocked the access routes and terminated the intruder's connections by the early hours of September 12, and remediated the exploited vulnerability the same day — but by then the data had already been taken.¹² The company confirmed the theft on September 14, reported the incident to Japan's Personal Information Protection Commission on September 15, and published a detailed notice on September 16.¹

Two datasets were disclosed. The first is roughly 23.62 million user records containing, depending on the account, names or nicknames, email addresses, password hashes, user and device IDs, login session IDs, X (Twitter) integration tokens, Google SSO email addresses, profile and language details, registration and last-login timestamps, subscription plan and billing status, and usage statistics.¹ No credit-card or other payment information was disclosed.¹ Importantly, Helpfeel is careful about that headline number: the 23.62 million records include anonymous accounts with no registered email address, and the company says it is "continuing to determine the actual number of individuals whose personal information was disclosed" — so the count of affected people is not the same as, and is likely lower than, the record count.¹

The second dataset is the one that deserves more attention than it has had: approximately 490 million image-metadata records, primarily for images registered in or before January 2019 (about 14.4% of all image-related data), plus metadata for a further ~2.4 million images retrieved through specific filtering.¹ That metadata is not the images themselves — Helpfeel found no loss of image data — but it includes the Image IDs used to construct Gyazo's shareable URLs, the source IP address of each upload, User-Agent strings, EXIF location data, OCR text extracted from the images, image titles, source URLs, and the hashed passphrases for private images.¹ Because those Image IDs can be used to build a working URL, the exposure created a path for a third party to view the corresponding content without authorization; Helpfeel has temporarily disabled viewing of affected images.¹ The attacker also obtained a list identifying private images, and Helpfeel says it cannot rule out that some private images were viewed.¹

Gyazo is a widely embedded tool, especially in gaming and technical communities; the service claims around 23 million users worldwide and 3.1 billion media items.²³ For a screenshot service, the metadata exposure is arguably the sharper harm: OCR text and EXIF geolocation attached to screenshots and photos, combined with URL-reconstructing IDs, can reveal the content people captured and where they were — not just their account details. On September 24, Helpfeel took Gyazo offline for security maintenance and advised users to reset passwords once the service resumes.¹

Verification of Claims

1. Claim: A third party breached Gyazo and stole user data and image metadata. → Verified → Confirmed in Helpfeel's own first-party disclosure: a vulnerability in Gyazo's image-upload server was exploited on September 11 for unauthorized access and arbitrary command execution, and the database was accessed.¹²

2. Claim: 23.6 million Gyazo users had their data breached. → Partially verified / imprecise → The 23.62 million figure counts records, and Helpfeel states these include anonymous accounts with no registered email and that the number of affected individuals is still being determined.¹ "23.6 million users" overstates a record count that has not been resolved to a person count.

3. Claim: 490 million Gyazo images were stolen. → False / imprecise → The 490 million figure is image-metadata records, not image files; Helpfeel found no loss of image data. The metadata (Image IDs, EXIF, OCR text, private-image passphrase hashes) is real and sensitive, but it is not the images, though exposed Image IDs can be used to reconstruct URLs and view some content.¹

4. Claim: Payment card data was exposed. → False → Helpfeel states no payment information, including credit-card numbers, was disclosed.¹

Timeline

Attack Anatomy

Helpfeel has not published the specific vulnerability, a CVE, or the attacker's identity, so the chain below is limited to what the company itself confirmed.

Initial access — the image-upload server vulnerability

The entry point was a vulnerability in Gyazo's image-upload server, which a third party exploited to gain unauthorized access and execute arbitrary commands on Helpfeel's systems (T1190, T1059).¹ Helpfeel has not disclosed the vulnerability class or a CVE.

Database access and bulk collection

From that foothold, the third party accessed Gyazo's database and pulled roughly 23.62 million user records and hundreds of millions of image-metadata records — a large-scale, automated extraction consistent with database access rather than per-record theft (T1005, T1119).¹

The metadata angle

Beyond account fields, the attacker took image metadata including the Image IDs that construct Gyazo URLs, EXIF geolocation, OCR text, and hashed private-image passphrases, plus a list identifying private images — turning a database breach into a potential means of viewing user content.¹

Threat Actor Profile

• Attacker: Unattributed. Helpfeel refers only to "a third party" and has not named an actor, published indicators, or stated a motive.¹
• Attribution confidence: Not applicable.
• Assessment: The theft of authentication material at scale — login session IDs, X integration tokens, Google SSO email addresses, password hashes — points to an actor interested in account access and downstream credential abuse, consistent with a financially or access-motivated data thief. Helpfeel says it has invalidated and restricted the authentication-related information involved.¹ Nothing in the disclosure indicates state activity or ransomware.

MITRE ATT&CK techniques (verified on attack.mitre.org):

Technical Indicators

# Helpfeel has not published a CVE, file hashes, or attacker infrastructure.
# The only concrete technical fact is the entry point and the data classes.
entry_point: "vulnerability in Gyazo's image-upload server (arbitrary command execution); CVE not disclosed"
user_records_exposed: "~23.62 million (records, includes anonymous accounts; individual count still being determined)"
user_data_classes:
  - "name/nickname, email, password hash"
  - "user ID, device ID, login session ID"
  - "X (Twitter) integration token; Google SSO email (if connected)"
  - "profile, language, registration/last-login timestamps, subscription plan, billing status"
  - "usage statistics"
payment_data: "not exposed"
image_metadata_exposed: "~490 million records (mostly images from before Jan 2019, ~14.4% of image data) + ~2.4 million via filtering"
image_metadata_classes:
  - "Image ID (constructs the image URL)"
  - "upload source IP address, User-Agent"
  - "EXIF location data, OCR-extracted text, image title, source URL"
  - "hashed passphrase for private images"
  - "a list identifying private images"
image_files: "no loss of image data confirmed; viewing of affected images temporarily disabled"
network_iocs: none disclosed
file_hashes: none disclosed

Legal and Regulatory Response

Helpfeel reported the incident to Japan's Personal Information Protection Commission on September 15, 2026, and is investigating with external experts.¹² It is notifying affected users by their registered email addresses, and — for anonymous accounts with no contact information — through the Gyazo web interface.¹ No regulatory finding, fine, or law-enforcement action has been reported at this stage; the response so far has been the company's own containment, credential invalidation, image-viewing suspension, and the September 24 maintenance shutdown.¹

Impact Assessment

• Confirmed: ~23.62 million user records disclosed, including password hashes and live authentication material (session IDs, X integration tokens, Google SSO emails), now invalidated/restricted by Helpfeel.¹
• Confirmed: ~490 million image-metadata records disclosed, including EXIF geolocation, OCR text, and Image IDs that can reconstruct image URLs; a list of private images obtained, with viewing of some private images not ruled out.¹
• Confirmed: No payment-card data disclosed; no confirmed loss of image files; no confirmed compromise of Helpfeel's other services (Helpfeel, Cosense).¹
• Unknown: The number of actual affected individuals (as distinct from the 23.62M records, which include anonymous accounts); the specific vulnerability exploited; the attacker's identity and motive; and how many private images, if any, were actually viewed.¹

Lessons and Defensive Recommendations

For Gyazo users:

• Change your Gyazo password once the service resumes, and change it anywhere you reused it — password hashes were taken. Treat active X and Google SSO connections as exposed even though Helpfeel says it invalidated authentication material.
• Be aware the exposure includes what your screenshots contained: OCR text and EXIF geolocation attached to images you thought were private or ephemeral. If you captured credentials, personal documents, or location-revealing images, assess that content as potentially exposed, not just your account.

For SaaS and platform operators:

• Image and file metadata is sensitive data, not bookkeeping. EXIF geolocation, OCR text, and — critically — the identifiers used to construct object URLs can turn a "metadata only" breach into unauthorized access to the underlying content. Store URL-constructing IDs as unguessable, revocable references, and treat OCR/EXIF as regulated personal data with the same protection as account fields.
• The distinction Helpfeel drew — records versus individuals, metadata versus image files — is the right way to disclose, and the right way to plan. Retention is the multiplier here: 490 million metadata records "primarily from before January 2019" means seven-year-old upload metadata was still on hand to steal. Minimize and expire metadata you no longer need.

For breach responders and communicators:

• Helpfeel's careful wording ("records," "including anonymous accounts," "still determining the number of individuals," "metadata, not images") is a model for not letting a headline number outrun the facts. Where a record count includes anonymous or duplicate entries, say so — because downstream coverage will otherwise convert "23.62 million records" into "23.6 million users" and "490 million metadata records" into "490 million images."

Sources