On September 11, 2026, an attacker exploited a vulnerability in Helpfeel's Gyazo image upload server to execute malicious commands and gain unauthorized access. The attacker accessed a database containing roughly 23.6 million user records, including sensitive personal and account information, as well as approximately 490 million image metadata records. The breach did not compromise payment card information. The attacker was removed on September 12, 2026. The exposed metadata and private image lists could potentially allow reconstruction and access to user-uploaded images. Helpfeel is investigating the full scope of affected individuals.

The breach exposed a large volume of user data including personally identifiable information (names, emails), password hashes, integration tokens, and billing details, which could facilitate identity theft, account takeover, or unauthorized access to user accounts. The exposure of image metadata and private image lists may allow attackers to reconstruct URLs and access private images. Payment card information was not compromised, reducing the risk of direct financial fraud. The breach affects millions of users globally.

Helpfeel has removed the attacker from its systems and is investigating the breach. Users should be notified to change their passwords and monitor their accounts for suspicious activity. Since the vulnerability was exploited in the image upload server, Helpfeel should apply security patches or fixes to that component. No official patch or remediation details are provided; therefore, users and administrators should follow vendor communications for updates. Payment card data was not compromised, so no action is required regarding payment information.