Helpfeel Inc. notice (16 September 2026 JST; Kyoto) confirms unauthorised access to Gyazo’s image-sharing service. On 11 September 2026 a third party exploited a vulnerability in Gyazo’s image upload server to run arbitrary commands; Helpfeel says it blocked access routes by early 12 September and remediated the flaw.

Confirmed disclosure: ~23.62 million user-related records (fields vary — may include name/nickname, email, password hash, user/device/session IDs, X/Twitter token, Google SSO email, profile/language, registration/last-login, plan and billing status without card numbers) and ~490 million image metadata records primarily for images registered in/before January 2019 (~14.4% of image-related data), plus ~2.4 million further metadata records via filtering. Metadata includes values used to build Gyazo image URLs (upload IP, User-Agent, EXIF location, OCR text, titles, source URLs, hashed passphrases for private images); Helpfeel temporarily disabled access to files whose records were exposed and cannot rule out that some private images were viewed.

Updated 19 Sep 2026 (BleepingComputer, 18 September US time; 12:00 am 19 September Perth): Gyazo service temporarily suspended for preventive maintenance while recovery continues; Helpfeel/Cosense not confirmed impacted beyond Gyazo; users being notified; no evidence of data deletion from this incident.

No payment-card data confirmed disclosed. Users: change Gyazo passwords and any reused passwords; report filed with Japan’s Personal Information Protection Commission. (sources: Helpfeel corp notice; BleepingComputer)

Updated 27 Sep 2026 (Helpfeel): Helpfeel says it resumed the Gyazo service on 27 September 2026 after a series of security measures and verification work (notice dated 26 September; first notice updated 27 September, 8:00 am JST, 7:00 am Perth).

Updated 21 Oct 2026 (Helpfeel): Helpfeel published a further notice with its final investigation results (Update 3). (source: Helpfeel)

Correction (26 Oct 2026): BleepingComputer and later Helpfeel notices now carry Updated lines with Perth dates. (sources: Helpfeel; BleepingComputer)

Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: Helpfeel; BleepingComputer)