Gyazo data breach exposes 23 million user records

Helpfeel Inc., the Kyoto-based operator of the image-sharing service Gyazo, has reported a major data breach following unauthorized access on September 11, 2026. Attackers exploited a vulnerability in the service’s image upload server to execute malicious commands and access backend systems.

The breach resulted in the exposure of approximately 23.62 million user records. Compromised data includes names, email addresses, password hashes, user and device IDs, X integration tokens, profile details, and usage statistics. While billing information was mentioned in some reports, the company clarified that credit card numbers and other payment-method information were not affected.

In addition to user records, the attackers accessed metadata associated with roughly 490 million images. This metadata includes information that could potentially be used to reconstruct image URLs, leading the company to temporarily suspend the delivery of some images to prevent unauthorized viewing. Helpfeel stated that it has since blocked the access routes, remediated the vulnerability, and is conducting further investigations with external experts.