Gyazo Breach Exposes 23.62 Million User Records and 490 Million Image Metadata Records

Helpfeel's Gyazo image-sharing service disclosed a breach exposing about 23.62 million user records and roughly 490 million image metadata records via a compromised upload server.

Helpfeel, the Kyoto-based operator of the Gyazo image-sharing service, disclosed on September 17, 2026 that a breach exposed approximately 23.62 million user records and about 490 million image metadata records. An attacker exploited a vulnerability in Gyazo's image upload server to run arbitrary commands and access the database. Exposed user data includes names, email addresses, password hashes, session IDs, and X integration tokens; no payment data was exposed. The image metadata records are mostly for images from January 2019 or earlier and include EXIF location data and OCR text. Leaked 32-character image IDs could enable unauthorized viewing of images, a list of private images was also obtained, and Helpfeel cannot rule out that private images were viewed. Helpfeel detected the intrusion on September 11, 2026, blocked access and fixed the flaw, reported the incident to Japan's Personal Information Protection Commission on September 15, and urged all users to change their passwords.

• Approximately 23.62 million user records were exposed, including names, email addresses, password hashes, session IDs, and X integration tokens; no payment data was exposed.
• About 490 million image metadata records were exposed, mostly for images from January 2019 or earlier; metadata included EXIF location data and OCR text.
• An attacker exploited a vulnerability in Gyazo's image upload server to run arbitrary commands and access the database.
• Leaked 32-character image IDs could enable unauthorized viewing of images; a list of private images was also obtained, and Helpfeel cannot rule out that private images were viewed.
• Helpfeel, based in Kyoto, detected the intrusion on September 11, 2026, blocked access and fixed the flaw, reported to Japan's Personal Information Protection Commission on September 15, and published its disclosure notice on September 17,…
• Helpfeel urged all Gyazo users to change their passwords.