Gyazo Hack Exposes 23.6 Million User Records and Image Data

Japanese software company Helpfeel is notifying users of its Gyazo image-sharing service after detecting unauthorised access to its servers. According to Helpfeel, an attacker exploited a vulnerability in an image-upload server on 11 September, allowing malicious commands to be executed. The attacker was removed the following day, but had accessed a database containing approximately 23.62 million user records.

The exposed data may include names, email addresses, password hashes, user and device IDs, X integration tokens, profile information, usage statistics and billing information. Helpfeel said payment card data was not compromised. The company cautioned that the total includes anonymous accounts without a registered email address, and that it is still determining how many individuals had personal information disclosed.

The attacker also accessed about 490 million image-metadata records. Helpfeel said this metadata could allow threat actors to reconstruct and access URLs linked to images uploaded to Gyazo. A list of private images was also compromised, although the company has not disclosed how many. The available report does not provide details of a CVE, the vulnerability’s technical mechanism, or specific remediation steps beyond the company’s investigation and notification.