Gyazo Breach Exposes 23.62 Million User Records and 490 Million Image Metadata Records
Helpfeel's Gyazo image-sharing service disclosed a breach exposing 23.62 million user records and 490 million image metadata records via a compromised upload server.
An attacker exploited a vulnerability in Gyazo's image upload server to run arbitrary commands and access the database, exposing about 23.62 million user records including names, email addresses, password hashes, session IDs, and X integration tokens, plus roughly 490 million image metadata records, mostly from January 2019 or earlier. Leaked 32-character image IDs could enable unauthorized viewing of images, and Helpfeel cannot rule out that private images were viewed; metadata included EXIF location data and OCR text. Helpfeel detected the intrusion on September 11, 2026, blocked access and fixed the flaw, reported to Japan's Personal Information Protection Commission on September 15, and urged all users to change their passwords; no payment data was exposed.
- Attacker exploited a vulnerability in Gyazo's image upload server, ran arbitrary commands, and accessed the database.
- Exposed user data includes names, emails, password hashes, session IDs, and X integration tokens; no payment data.
- Leaked 32-character image IDs could enable unauthorized image viewing; a list of private images was also obtained.
- Helpfeel detected the intrusion September 11, reported to Japan's regulator September 15, and urged password changes.
From the original article
4 min read at thehackernews.com
A security breach at Gyazo, Helpfeel's image-sharing service, exposed about 23. 62 million user records, including email addresses and password hashes, the Kyoto-based company said in a notice published Wednesday. It also exposed about 490 million image metadata records, mostly for images from January 2019 or earlier, including the IDs that make up Gyazo image links.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.