Gyazo Data Breach Exposes 23 Million User Records
Attackers exploited a flaw in Gyazo's image upload server, exposing 23.6 million user records and about 490 million image metadata entries.
Japanese software company Helpfeel is notifying Gyazo users that attackers exploited a vulnerability in the image upload server on September 11, ran malicious commands, and accessed a database with approximately 23.62 million user records before being locked out the next day. Stolen data includes names, email addresses, password hashes, user and device IDs, X integration tokens, profile details and billing information. About 490 million image metadata records were also exposed, including upload IP addresses, User-Agent data, EXIF location information, OCR text and hashed passphrases for private images, plus a list of private images. Payment card data was not affected, remediation is complete, and the investigation is ongoing.
- Vulnerability in Gyazo's image upload server exploited September 11; attacker locked out September 12.
- 23.62 million user records exposed, including password hashes and X integration tokens.
- 490 million image metadata records exposed; a list of private images was obtained.
- Metadata includes upload IPs, User-Agent, EXIF location data and OCR text.
- No payment card data affected; users urged to change passwords.
From the original article
3 min read at securityaffairs.com
A Gyazo breach exposed 23 million user records after attackers exploited a vulnerability in Helpfeel’s image upload server. Japanese software company Helpfeel is notifying Gyazo users about a data breach that compromised 23 million user records. Attackers gained unauthorized access by exploiting a vulnerability in the service’s image upload server.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.