BreachPublished 18 Sep 2026

23 Million User Records Compromised in Gyazo Data Breach

Source SecurityWeek

Description

Helpfeel, the maker of the Gyazo image-sharing service, disclosed a data breach resulting from an exploited vulnerability in its image upload server. The attacker gained unauthorized access on September 11, 2026, and was removed the following day but accessed approximately 23.6 million user records and 490 million image metadata records. Compromised user data includes names, email addresses, password hashes, user and device IDs, integration tokens, profile information, usage statistics, and billing information. Payment card data was not affected. The breach also exposed private image lists and metadata that could allow reconstruction of image URLs. The exact number of individuals impacted is still being determined.

Impact

The breach exposed a large volume of user data including personally identifiable information (names, emails), password hashes, integration tokens, and billing details, which could facilitate identity theft, account takeover, or unauthorized access to user accounts. The exposure of image metadata and private image lists may allow attackers to reconstruct URLs and access private images. Payment card information was not compromised, reducing the risk of direct financial fraud. The breach affects millions of users globally.

Defensive guidance

Helpfeel has removed the attacker from its systems and is investigating the breach. Users should be notified to change their passwords and monitor their accounts for suspicious activity. Since the vulnerability was exploited in the image upload server, Helpfeel should apply security patches or fixes to that component. Payment card data was not compromised, so no action is required regarding payment information.

Summary

On September 11, 2026, an attacker exploited a vulnerability in Helpfeel's Gyazo image upload server to execute malicious commands and gain unauthorized access. The attacker accessed a database containing roughly 23.6 million user records, including sensitive personal and account information, as well as approximately 490 million image metadata records. The breach did not compromise payment card information. The attacker was removed on September 12, 2026. The exposed metadata and private image lists could potentially allow reconstruction and access to user-uploaded images. Helpfeel is investigating the full scope of affected individuals.

References

securityweek.com/23-million-user-records-compromised-in-gyazo-data-breach/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 18 Sep 2026, 11:46 UTC

References

Community reviews