Japanese tech services Zaim and Gyazo report security breaches

Two Japanese technology services, the household account app Zaim and the image-sharing service Gyazo, have reported security incidents involving unauthorized access.

Kufu Company announced that a system flaw allowed a third party to overwrite the registration information of 14 Zaim users between September 18 and 19, 2026. The affected data included nicknames, email addresses, and legacy password-related information. The company has since restored the data and stated that no actual information leakage or unauthorized logins to accounts were confirmed.

Helpfeel Inc. reported a significant data breach involving Gyazo, where a vulnerability in an image upload server allowed unauthorized command execution. Approximately 23.62 million pieces of user data were leaked, including email addresses, hashed passwords, user IDs, and session IDs. The breach also involved the exposure of metadata for hundreds of millions of images, including IP addresses, EXIF location data, and OCR text. Helpfeel noted that its other services, Helpfeel and Cosense, remain unaffected by the breach, though some images displayed via Gyazo may be temporarily unavailable.