Hackers exploit Gyazo server flaw to steal 23.6 million user records
Helpfeel confirmed attackers exploited a Gyazo upload-server flaw, stealing 23.62 million user records and roughly 490 million image metadata records.
Helpfeel said the attacker exploited a vulnerability in Gyazo's image upload server on September 11 to execute arbitrary commands, with access routes blocked by early September 12. Stolen data includes 23.62 million user records with names, email addresses, password hashes, session IDs, and X integration tokens, plus about 490 million image metadata records covering upload IPs, EXIF location data, OCR text, and hashed passphrases protecting private images. No payment data was taken, but the company cannot rule out that private images were viewed, and it reported the incident to Japan's Personal Information Protection Commission on September 15.
- 23.62 million user records including password hashes, session IDs, and X integration tokens stolen
- About 490 million image metadata records exposed, including EXIF location and OCR text
- List of private images obtained; access to private images cannot be ruled out
- No payment data affected; reported to Japan's Personal Information Protection Commission
- Service paused image delivery; users urged to change passwords
From the original article
2 min read at helpnetsecurity.com
Japanese software company Helpfeel has confirmed a data breach on its screenshot-sharing platform Gyazo, in which attackers exploited a vulnerability in its image upload server, stealing approximately 23. 62 million user records and metadata tied to hundreds of millions of images.
By Sinisa Markovic · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.