Hackers exploit Gyazo server flaw to steal 23.6 million user records
Helpfeel confirmed attackers exploited a Gyazo upload-server flaw, stealing 23.62 million user records and roughly 490 million image metadata records.
Helpfeel said the attacker exploited a vulnerability in Gyazo's image upload server on September 11 to execute arbitrary commands, with access routes blocked by early September 12. Stolen data includes 23.62 million user records with names, email addresses, password hashes, session IDs, and X integration tokens, plus about 490 million image metadata records covering upload IPs, EXIF location data, OCR text, and hashed passphrases protecting private images. No payment data was taken, but the company cannot rule out that private images were viewed, and it reported the incident to Japan's Personal Information Protection Commission on September 15.
- 23.62 million user records including password hashes, session IDs, and X integration tokens stolen
- About 490 million image metadata records exposed, including EXIF location and OCR text
- List of private images obtained; access to private images cannot be ruled out
- No payment data affected; reported to Japan's Personal Information Protection Commission
- Service paused image delivery; users urged to change passwords
Full article485 words · extracted from helpnetsecurity.com · click to collapse
Japanese software company Helpfeel has confirmed a data breach on its screenshot-sharing platform Gyazo, in which attackers exploited a vulnerability in its image upload server, stealing approximately 23.62 million user records and metadata tied to hundreds of millions of images.
Gyazo is a cloud-based screenshot and screen-recording service that uploads users’ captures automatically and generates a shareable link they can post in chats, forums, or social media.
According to the company, an attacker exploited the vulnerability on September 11 to gain unauthorized access to Gyazo’s systems and run arbitrary commands. Suspicious activity was detected that same evening, and by the early hours of September 12, the access routes had been blocked and the attacker’s connections cut off.
“Our subsequent investigation confirmed that the third party had accessed Gyazo’s database and that user information and metadata associated with uploaded images had been disclosed without authorization,” the company said.
Based on its investigation, the company found that the stolen user records, around 23.62 million of them, include names, email addresses, password hashes, user IDs, device IDs, login session IDs, X integration tokens for connected accounts, Google SSO email addresses, profile information, language preferences, registration and login timestamps, subscription plans, and billing status.
“We have confirmed that no payment information, including credit card numbers, was disclosed without authorization.”
The image metadata is larger in scope, approximately 490 million records, tied mostly to images uploaded in or before January 2019, about 14.4% of all image data on the platform.
An additional 2.4 million images were separately pulled through specific filtering. This metadata included image IDs used to build image URLs, upload IP addresses, user agents, EXIF location data where present, OCR text extracted from images, image titles, source URLs, and hashed passphrases protecting private images.
“We have also confirmed that the third party obtained a list identifying private images. As we cannot rule out the possibility that some private images may have been viewed by the third party, we are continuing our detailed investigation,” it added.
The company also said its investigation has found no sign that data was taken from its other two services, Helpfeel and Cosense. Some images embedded in those tools through Gyazo may still be unavailable, since Gyazo paused image delivery in response to the incident.
Helpfeel reported the incident to Japan’s Personal Information Protection Commission on September 15. It plans to notify affected users by email, and through the Gyazo web interface for anonymous accounts that have no registered email address.
“We ask all Gyazo users to change their passwords,” the notice reads, extending the same advice to any other account sharing the same or a similar password.
“We sincerely apologize to all Gyazo users and other affected parties for the significant concern and inconvenience caused by this incident,” Helpfeel wrote.
At the time of writing, Gyazo’s homepage still shows a maintenance notice, with no timeline given for when the service will return.