Gyazo (Helpfeel): ~23.62M user records + ~490M image metadata exposed after upload-server RCE
Helpfeel Inc. notice (16 September 2026 JST; Kyoto) confirms unauthorised access to Gyazo’s image-sharing service. On 11 September 2026 a third party exploited a vulnerability in Gyazo’s image upload server to run arbitrary commands; Helpfeel says it blocked access routes by early 12 September and remediated the flaw. Confirmed disclosure: ~23.62 million user-related records (fields vary — may include name/nickname, email, password hash, user/device/session IDs, X/Twitter token, Google SSO email, profile/language, registration/last-login, plan and billing status without card numbers) and ~490 million image metadata records primarily for images registered in/before January 2019 (~14.4% of image-related data), plus ~2.4 million further metadata records via filtering. Metadata includes values used to build Gyazo image URLs (upload IP, User-Agent, EXIF location, OCR text, titles, source URLs, hashed passphrases for private images); Helpfeel temporarily disabled access to files whose records were exposed and cannot rule out that some private images were viewed. UPDATE 18 Sep 2026 (BleepingComputer): Gyazo service temporarily suspended for preventive maintenance while recovery continues; Helpfeel/Cosense not confirmed impacted beyond Gyazo; users being notified; no evidence of data deletion from this incident. No payment-card data confirmed disclosed. Users: change Gyazo passwords and any reused passwords; report filed with Japan’s Personal Information Protection Commission. Primary: Helpfeel corp notice; wires: THN 17 Sep / BleepingComputer 18 Sep.
- Product
- Gyazo (Helpfeel Inc. image-sharing / screenshot service)
- Versions
- n/a (SaaS incident; upload-server vulnerability remediated per vendor)
- Exploited in Australia?
- unknown
- Patch to
- Gyazo users: change password and any reused passwords; watch phishing; treat old image URLs as potentially enumerable if metadata leaked; expect service downtime while Gyazo remains suspended for maintenance; operators using Gyazo embeds: plan alternate screenshot/CDN delivery
Primary: Helpfeel — Gyazo unauthorised access notice (16 Sep 2026) · Vendor: Helpfeel Inc. — Gyazo breach notice · BleepingComputer — Gyazo 23.6M records / service suspended (18 Sep 2026)