Gyazo Breach Exposes 23.6 Million User Records and 490 Million Image Metadata Records
Summary
Helpfeel says an attacker exploited Gyazo’s image upload server, accessing about 23.6 million user records and 490 million image metadata records. Payment card data was not compromised.
Key points
- Helpfeel detected unauthorized access to Gyazo servers after an attacker exploited a vulnerability in the image upload server on September 11.
- The attacker was removed the following day.
- About 23.6 million user records were accessed; the count includes anonymous accounts, and Helpfeel is still determining how many individuals had personal information disclosed.
- Exposed information includes names, email addresses, password hashes, user and device IDs, X integration tokens, profile information, usage statistics, and billing information.
- The attacker also accessed about 490 million image metadata records that could help reconstruct and access URLs for uploaded images.
- A list of private images was also accessed, but Helpfeel has not disclosed its size.
- Helpfeel said payment card information was not compromised.
Article Details
- Victim Organization
- Helpfeel
- Incident Type
- Unauthorized access to Gyazo servers after exploitation of a vulnerability in the image upload server
- Incident Date
- 2026-09-11
- Data Types Exposed
- Names
- Email addresses
- Password hashes
- User and device IDs
- X integration tokens
- Profile information
- Usage statistics
- Billing information
- Image metadata
- Private image list
- Affected Records
- Approximately 23.62 million user records, including anonymous accounts; approximately 490 million image metadata records. The number of individuals whose personal information was disclosed is still being determined.
- Operational Impact
- The attacker accessed Gyazo servers and a database; the attacker was removed the day after access began. Payment card information was not compromised, according to Helpfeel.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed