# Gyazo Data Breach: Helpfeel Discloses 23.62M User Records and ~492M Image Metadata Records Exposed via Image Upload Server Exploit

> Helpfeel Inc., the Kyoto-based operator of the Gyazo image-sharing/screenshot service, disclosed on 2026-09-16 that a third party exploited a vulnerability in Gyazo's image upload server on 2026-09-11 to gain unauthorized access and execute arbitrary commands, ultimately reaching Gyazo's database. Approximately 23.62 million user records (names, emails, password hashes, device/session IDs, X/Twitter and Google SSO tokens, billing status) and roughly 492.4 million image metadata records (image IDs, IPs, EXIF location, OCR text, hashed private-image passphrases) were exposed; payment card data was not affected.

- **Published:** 2026-09-18T00:00:00Z
- **Last reviewed:** 2026-09-18T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2566
- **ID:** TL-2026-2566
- **Severity:** HIGH
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On the evening of September 11, 2026 (Japan time), an unauthorized third party exploited a vulnerability in the image upload server operated by Helpfeel Inc. for its Gyazo image-sharing and screenshot service, gaining unauthorized access to Helpfeel's systems and executing arbitrary commands. Multiple secondary outlets (The Hacker News, RodTrent's roundup) characterize this as a critical server-side flaw in the upload component, consistent with unsafe file-handling or input-validation weaknesses, though Helpfeel itself has not disclosed the specific vulnerability class or CVE. Helpfeel detected the suspicious activity the same evening and began an incident response; by the early hours of September 12 the company had blocked the identified access routes, terminated the attacker's active connections, and patched the exploited vulnerability — a containment window of roughly 24 hours from detection to remediation.

Helpfeel's own notice states that its other products, Helpfeel (the help-center/FAQ SaaS) and Cosense (formerly Scrapbox), run on "different system architectures" and showed no confirmed unauthorized disclosure, indicating the compromise was scoped to the Gyazo image upload server and its backing database rather than Helpfeel's broader corporate environment.

On September 14, Helpfeel confirmed that data had been unauthorizedly disclosed and suspended image delivery as a precaution. On September 15, the company implemented additional protective measures — invalidating and restricting existing authentication/session tokens — and submitted a breach report to Japan's Personal Information Protection Commission (PPC), as required under Japan's Act on the Protection of Personal Information. On September 16, Helpfeel published a public notice and apology disclosing the scope of the incident and urging all Gyazo users to change their password, and to change it on any other service where the same or a similar password was reused.

The exposed user dataset comprises approximately 23.62 million records, including accounts with no registered email (anonymous accounts). Fields include names, email addresses, password hash values, user IDs, device IDs, login session IDs, X (formerly Twitter) integration tokens, Google SSO linkage emails, profile/language preferences, registration and login dates, subscription plan, and billing status; Helpfeel states payment card numbers were not compromised. The Hacker News additionally reported that whether the exposed login session IDs remain cryptographically valid — and whether Gyazo's new-IP login verification would block their reuse — was not clearly resolved by Helpfeel's disclosure at the time of reporting, leaving open a residual account-takeover/session-hijack risk pending full confirmation of token invalidation.

Separately, roughly 490 million image metadata records tied to images registered before January 2019, plus an additional 2.4 million records retrieved via what Helpfeel described as "specific filtering criteria," were exposed. This metadata includes the 32-character image IDs that compose Gyazo share URLs (Gyazo markets these as effectively "unguessable," using ID secrecy as the primary access control for default-privacy images), uploader IP addresses and User-Agent strings, EXIF geolocation data embedded in images, OCR text Gyazo extracts from paid users' captures (which Gyazo's own documentation states only the uploader can see), image titles/source URLs, and hashed passphrases protecting private images. Because the image IDs themselves were exposed, the sole access-control mechanism protecting many default-privacy captures has been defeated, making URL reconstruction and unauthorized viewing of historical images feasible without any enumeration or brute-forcing — the leaked IDs are themselves the secret. Reporting also indicates the attacker obtained a list specifically identifying which images were flagged private, and Helpfeel has stated it "cannot rule out the possibility that the third party may have viewed some private images." Helpfeel has temporarily disabled delivery of some existing (unnamed subset of) images and resumed delivery only for newly uploaded content while the investigation continues; because the image ID is the sole secret, deletion — not rotation — is the only mitigation available for already-exposed links. An external forensics firm is conducting an ongoing investigation, with Helpfeel committing to publish further findings as they become available. No threat actor has claimed the intrusion and no attribution has been reported by any outlet as of 2026-09-18.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1213 Data from Information Repositories
- T1119 Automated Collection
- T1528 Steal Application Access Token
- T1110.004 Credential Stuffing
- T1078 Valid Accounts
- T1589.001 Credentials
- T1589.002 Email Addresses
- T1566 Phishing

## Sources

- [23 Million User Records Compromised in Gyazo Data Breach](https://www.securityweek.com/23-million-user-records-compromised-in-gyazo-data-breach/)
- [Notice and Apology Regarding a Data Breach Resulting from Unauthorized Access to Gyazo](https://corp.helpfeel.com/en/news/news-20260916)
- [Gyazo Breach Exposes 23.62 Million User Records and 490 Million Image Metadata Records](https://thehackernews.com/2026/09/gyazo-breach-exposes-2362-million-user.html)
- [Gyazo Breach Exposes 23.62 Million User Records and 490 Million Image Metadata Records](https://databreaches.net/2026/09/17/gyazo-breach-exposes-23-62-million-user-records-and-490-million-image-metadata-records/)
- [Gyazo data breach leaves over 23 million user records exposed, includes half a billion metadata points](https://cybernews.com/security/helpfeel-gyazo-data-breach-exposed-millions-records/)
- [Gyazo breach exposes 23.62 million user records and 490 million image records — PII and metadata exposed in huge attack](https://www.techradar.com/pro/security/gyazo-breach-exposes-23-62-million-user-records-and-490-million-image-records-pii-and-metadata-exposed-in-huge-attack)
- [Japan's Helpfeel says Gyazo data breach exposed 24m user records](https://www.mlex.com/mlex/articles/2526447/japan-s-helpfeel-says-gyazo-data-breach-exposed-24m-user-records)
- [Gyazo Breach Exposes Link IDs Behind Private Captures](https://sqmagazine.co.uk/gyazo-breach-exposes-link-ids-private-captures/)
- [Security Check-in Quick Hits: Cisco ISE Zero-Day Under Active Attack, Gyazo's 23.6M-Record Breach, and FamousSparrow's SparroWocky Espionage Push](https://rodtrent.substack.com/p/security-check-in-quick-hits-cisco-8a9)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2566