Gyazo Data Breach: Helpfeel Discloses 23.62M User Records and ~492M Image Metadata Records Exposed via Image Upload Server Exploit

Key facts for Gyazo image metadata breach

Detection coverage for Gyazo image metadata breach

As of 2026-09-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2566 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Bulk/Automated SELECT Volume Against User & Image Metadata Tables

Detects abnormally high-volume or automated-pattern SELECT queries against user-account and image-metadata tables from a single session/service account in a short window, consistent with the mass collection described in Helpfeel's disclosure (~23.62M user records and ~492M image metadata records exfiltrated, including a 2.4M-record subset pulled via 'specific filtering criteria'). Maps to Data from Information Repositories (T1213) and Automated Collection (T1119).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1213, T1119
• Data sources: MySQL/PostgreSQL audit logs, MongoDB audit logs, database proxy logs
• Severity: critical
• Confidence: medium

Splunk SPL

index=db sourcetype IN ("mysql:audit","postgres:audit","mongodb:audit") (query="*SELECT*" AND (query="*users*" OR query="*image_metadata*" OR query="*sessions*"))
| bin _time span=5m
| stats count as query_count, dc(table) as distinct_tables, values(table) as tables by _time, db_user, client_ip
| where query_count > 500 OR (query_count > 100 AND distinct_tables >= 2)
| eval risk_reason="anomalous bulk/automated SELECT volume against user or image metadata tables"
| sort -query_count

Microsoft KQL

AzureDiagnostics
| where TimeGenerated > ago(24h)
| where Category == "SQLSecurityAuditEvents" or ResourceType == "POSTGRESQLFLEXIBLESERVERS"
| where statement_s has_any ("SELECT") and (statement_s has "users" or statement_s has "image_metadata" or statement_s has "sessions")
| summarize QueryCount = count(), DistinctTables = dcount(statement_s) by bin(TimeGenerated, 5m), client_principal_name_s, client_ip_s
| where QueryCount > 500 or DistinctTables >= 2
| order by QueryCount desc

Sigma

title: Anomalous Bulk SELECT Query Volume Against User/Image Metadata Tables
id: 7c1e2a10-2a22-4a22-8a22-222222222222
status: experimental
description: Detects a spike in SELECT queries against user-account or image-metadata tables from a single database session, consistent with automated bulk data collection/exfiltration such as the ~23.62M-record and ~492M-record exposure in the Gyazo/Helpfeel breach.
references:
    - https://www.securityweek.com/23-million-user-records-compromised-in-gyazo-data-breach/
    - https://attack.mitre.org/techniques/T1213/
    - https://attack.mitre.org/techniques/T1119/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-18
tags:
    - attack.collection
    - attack.t1213
    - attack.t1119
logsource:
    category: database
detection:
    selection:
        query|contains: 'SELECT'
        query|contains|all:
            - 'users'
    timeframe: 5m
    condition: selection | count() by client_ip > 500
falsepositives:
    - Scheduled analytics/ETL jobs performing legitimate bulk reads
    - Database backup or migration processes
level: high

Known false positives:

• Scheduled ETL/analytics jobs or nightly backup processes against the same tables
• Legitimate admin data-migration scripts

Tuning notes: Baseline normal query volume per known service/ETL account first and exclude those accounts explicitly rather than raising the global threshold, since raising the threshold would blind the rule to slow, low-and-slow bulk exfiltration similar to the 2.4M-record filtered subset Helpfeel described.

• 🔒 Web/App Server Process Spawning Command Interpreter or Download Utility (Upload-Server RCE) · unlock with TL Creds
• 🔒 Anomalous Mass Data Export / DB Dump Utility Execution on Database Host · unlock with TL Creds
• 🔒 OAuth/SSO Token Anomaly or Impossible-Travel Session Reuse Post-Breach · unlock with TL Creds
• 🔒 Image/Upload Handler Process Spawning Command Interpreter · unlock with TL Creds
• 🔒 High-Volume Automated Query Pattern Against Image/User Database (Sigma) · unlock with TL Creds
• 🔒 Mass Failed-Then-Success Authentication Pattern Post-Breach (Credential Stuffing / Account Takeover) · unlock with TL Creds
• 🔒 Anomalous Oversized/Malformed POST to Image Upload Endpoint · unlock with TL Creds
• 🔒 Credential-Stuffing Spike Against Login Endpoint Following Breach Disclosure · unlock with TL Creds

Indicators of compromise for Gyazo image metadata breach

As of 2026-09-18, Threadlinqs Intelligence tracks 9 indicators of compromise for TL-2026-2566.

How Gyazo image metadata breach works

Approximately 23.62 million user records (names, emails, password hashes, device/session IDs, X/Twitter and Google SSO tokens, billing status) and roughly 492.4 million image metadata records (image IDs, IPs, EXIF location, OCR text, hashed private-image passphrases) were exposed; payment card data was not affected.

On the evening of September 11, 2026 (Japan time), an unauthorized third party exploited a vulnerability in the image upload server operated by Helpfeel Inc. for its Gyazo image-sharing and screenshot service, gaining unauthorized access to Helpfeel's systems and executing arbitrary commands. Multiple secondary outlets (The Hacker News, RodTrent's roundup) characterize this as a critical server-side flaw in the upload component, consistent with unsafe file-handling or input-validation weaknesses, though Helpfeel itself has not disclosed the specific vulnerability class or CVE. Helpfeel detected the suspicious activity the same evening and began an incident response; by the early hours of September 12 the company had blocked the identified access routes, terminated the attacker's active connections, and patched the exploited vulnerability — a containment window of roughly 24 hours from detection to remediation.

Helpfeel's own notice states that its other products, Helpfeel (the help-center/FAQ SaaS) and Cosense (formerly Scrapbox), run on "different system architectures" and showed no confirmed unauthorized disclosure, indicating the compromise was scoped to the Gyazo image upload server and its backing database rather than Helpfeel's broader corporate environment.

On September 14, Helpfeel confirmed that data had been unauthorizedly disclosed and suspended image delivery as a precaution. On September 15, the company implemented additional protective measures — invalidating and restricting existing authentication/session tokens — and submitted a breach report to Japan's Personal Information Protection Commission (PPC), as required under Japan's Act on the Protection of Personal Information. On September 16, Helpfeel published a public notice and apology disclosing the scope of the incident and urging all Gyazo users to change their password, and to change it on any other service where the same or a similar password was reused.

The exposed user dataset comprises approximately 23.62 million records, including accounts with no registered email (anonymous accounts). Fields include names, email addresses, password hash values, user IDs, device IDs, login session IDs, X (formerly Twitter) integration tokens, Google SSO linkage emails, profile/language preferences, registration and login dates, subscription plan, and billing status; Helpfeel states payment card numbers were not compromised. The Hacker News additionally reported that whether the exposed login session IDs remain cryptographically valid — and whether Gyazo's new-IP login verification would block their reuse — was not clearly resolved by Helpfeel's disclosure at the time of reporting, leaving open a residual account-takeover/session-hijack risk pending full confirmation of token invalidation.

Separately, roughly 490 million image metadata records tied to images registered before January 2019, plus an additional 2.4 million records retrieved via what Helpfeel described as "specific filtering criteria," were exposed. This metadata includes the 32-character image IDs that compose Gyazo share URLs (Gyazo markets these as effectively "unguessable," using ID secrecy as the primary access control for default-privacy images), uploader IP addresses and User-Agent strings, EXIF geolocation data embedded in images, OCR text Gyazo extracts from paid users' captures (which Gyazo's own documentation states only the uploader can see), image titles/source URLs, and hashed passphrases protecting private images. Because the image IDs themselves were exposed, the sole access-control mechanism protecting many default-privacy captures has been defeated, making URL reconstruction and unauthorized viewing of historical images feasible without any enumeration or brute-forcing — the leaked IDs are themselves the secret. Reporting also indicates the attacker obtained a list specifically identifying which images were flagged private, and Helpfeel has stated it "cannot rule out the possibility that the third party may have viewed some private images." Helpfeel has temporarily disabled delivery of some existing (unnamed subset of) images and resumed delivery only for newly uploaded content while the investigation continues; because the image ID is the sole secret, deletion — not rotation — is the only mitigation available for already-exposed links. An external forensics firm is conducting an ongoing investigation, with Helpfeel committing to publish further findings as they become available. No threat actor has claimed the intrusion and no attribution has been reported by any outlet as of 2026-09-18.

MITRE ATT&CK techniques by tactic:

Execution

T1059 Command and Scripting Interpreter

Persistence

T1078 Valid Accounts

Credential Access

T1110.004 Credential Stuffing; T1528 Steal Application Access Token

Collection

T1119 Automated Collection; T1213 Data from Information Repositories

Initial Access

T1190 Exploit Public-Facing Application; T1566 Phishing

Reconnaissance

T1589.001 Credentials; T1589.002 Email Addresses

Remediation for Gyazo image metadata breach

Patches

• Image upload server vulnerability remediated by Helpfeel on 2026-09-12; specific vulnerability class/CWE not publicly disclosed by the vendor

Immediate actions

• Blocked the identified unauthorized access routes and terminated the attacker's active connections (completed by Helpfeel on 2026-09-12)
• Patched the exploited image upload server vulnerability the same day it was identified (2026-09-12)
• Temporarily suspended/restricted image delivery and viewing of existing images to limit further exposure (from 2026-09-14)
• Invalidated and restricted existing authentication and session tokens (2026-09-15)
• All Gyazo/Helpfeel account holders should change their Gyazo password immediately, and change it on any other service where the same or a similar password was reused

Workarounds

• Restrict or re-verify exposure of legacy (pre-January 2019) Gyazo image links until Helpfeel completes remediation of the metadata exposure
• Do not rely on Gyazo private-image passphrases for sensitive content until Helpfeel confirms passphrase/credential rotation

Longer-term hardening

• Users should review and re-authorize or revoke X (Twitter) and Google SSO integrations linked to their Gyazo account given the exposed integration/session tokens
• Treat previously 'private' Gyazo capture links as compromised; do not rely on 32-character image-ID secrecy as sole access control going forward, particularly for pre-2019 uploads
• Monitor for phishing, credential-stuffing, and social-engineering attempts referencing exposed Gyazo/Helpfeel account data (Helpfeel and outlets both flagged secondary phishing risk)
• Helpfeel should confirm and publicly clarify whether previously issued login session IDs were fully invalidated (rather than merely 'restricted'), and whether new-IP login verification is enforced, to close the residual session-hijack window
• Helpfeel should complete and publish the external forensic investigation, including root-cause/vulnerability-class disclosure, once available

Affected and fixed versions

• Helpfeel Inc. — Gyazo (image upload server / image-sharing platform)
  Vulnerable versions: Gyazo production image upload server and backing database, active as of 2026-09-11
  Fixed in: Patched by Helpfeel on 2026-09-12; specific version/build not publicly disclosed
• Helpfeel Inc. — Helpfeel (help-center/FAQ SaaS) and Cosense (formerly Scrapbox)

Timeline of Gyazo image metadata breach

• 2026-09-11 Helpfeel detected suspicious activity the same evening and began incident investigation and response.
• 2026-09-11 Evening (Japan time): an unauthorized third party exploited a vulnerability in locked-ioc-9's image upload server, gaining unauthorized access to Helpfeel's systems and executing arbitrary commands.
• 2026-09-12 Helpfeel patched the exploited image upload server vulnerability the same day access was blocked, closing a roughly 24-hour detection-to-remediation window.
• 2026-09-12 Early morning: Helpfeel blocked the identified access routes and terminated the attacker's unauthorized connections.
• 2026-09-14 Helpfeel confirmed unauthorized disclosure of data had occurred and suspended image delivery as a precautionary measure.
• 2026-09-15 Helpfeel submitted a breach report to Japan's Personal Information Protection Commission (PPC).
• 2026-09-15 Helpfeel implemented additional protective measures, invalidating and restricting existing authentication/session tokens, though The Hacker News later reported the completeness of session-ID invalidation remained unclear.
• 2026-09-16 Helpfeel published a public notice and apology disclosing the breach's scope (~23.62M user records, ~492.4M image metadata records), confirming its Helpfeel and Cosense products on separate architectures were not confirmed affected, and urged all users to change their locked-ioc-9 password and any reused passwords elsewhere.
• 2026-09-17 The Hacker News, DataBreaches.Net, Cybernews, TechRadar, MLex, SQ Magazine, and other outlets published independent coverage and analysis of the disclosure, including risk analysis of the exposed image-ID access-control model and residual session-validity questions.
• 2026-09-18 SecurityWeek published coverage of the breach; Helpfeel's external forensic investigation remains ongoing with further findings pending.

Sources cited for Gyazo image metadata breach

• Notice and Apology Regarding a Data Breach Resulting from Unauthorized Access to Gyazo corp.helpfeel.com · Vendor report · 2026-09-16
• Gyazo Breach Exposes Link IDs Behind Private Captures sqmagazine.co.uk · Blog · 2026-09-17
• Security Check-in Quick Hits: Cisco ISE Zero-Day Under Active Attack, Gyazo's 23.6M-Record Breach, and FamousSparrow's SparroWocky Espionage Push rodtrent.substack.com · Blog · 2026-09-17
• 23 Million User Records Compromised in Gyazo Data Breach SecurityWeek · News · 2026-09-18
• Gyazo Breach Exposes 23.62 Million User Records and 490 Million Image Metadata Records The Hacker News · News · 2026-09-17
• Gyazo Breach Exposes 23.62 Million User Records and 490 Million Image Metadata Records databreaches.net · News · 2026-09-17
• Gyazo data breach leaves over 23 million user records exposed, includes half a billion metadata points cybernews.com · News · 2026-09-17
• Gyazo breach exposes 23.62 million user records and 490 million image records — PII and metadata exposed in huge attack techradar.com · News · 2026-09-17
• Japan's Helpfeel says Gyazo data breach exposed 24m user records mlex.com · News · 2026-09-17

More in data breach

• DreamHost Data Breach via Third-Party File Manager Flaw Exposes FTP/SFTP and Webmail Credentials
• WorkOS Internal Sales App Breached by Attacker Using ARTEX AI Offensive Framework
• Frontline Education Data Breach via Third-Party Software Vulnerability Impacts Over 1.3 Million People
• Chainalysis Confirms Cyberattack: Unauthorized Access to Internal Tools via 'Offensive Agentic Techniques' Exposes Customer Account Data
• Binance security incident: compromised DevOps engineer laptop leads to service container access and ~$6.3 billion in unauthorized withdrawals