[CLSTR]
< Back to situations

Monitor this situation.

[SITUATION] · [QUIET] · [TECHNOLOGY]

3 clusters · 9 sources · 11 days · First seen · Last updated

Gyazo data breach

Overview

Kyoto-based Helpfeel Inc., the operator of the image-sharing service Gyazo, reported a major data breach following unauthorized access on September 11, 2026. Attackers exploited a vulnerability in the service’s image upload server to execute malicious commands and access backend systems.

The breach exposed approximately 23.6 million user records. Compromised information includes names, email addresses, password hashes, user and device IDs, X integration tokens, Google SSO email addresses, profile details, and subscription information. While the company clarified that credit card numbers and payment-method information were not affected, attackers also accessed metadata associated with roughly 490 million images and videos, primarily those uploaded before January 2019.

Recent reports confirm the scope of the metadata exposure includes IP addresses, EXIF location data, and OCR text. Helpfeel Inc. has noted that its other services, Helpfeel and Cosense, remain unaffected by the breach, though some images displayed via Gyazo may be temporarily unavailable.

In response to the incident, Gyazo temporarily suspended certain services to perform maintenance and patch the security flaw. The company stated that it has since blocked the access routes, remediated the vulnerability, and is conducting further investigations with external experts.

Entities

Gyazo · Helpfeel Inc. · Kufu Company · Zaim · HALMEK up

Timeline

  1. [TECHNOLOGY] 4 sources
    Japanese tech services Zaim and Gyazo report security breaches

    Japanese services Zaim and Gyazo reported security breaches. Zaim saw registration data overwritten for 14 users, while Gyazo suffered a massive leak of 23.62 million user records and image metadata.

  2. [TECHNOLOGY] 2 sources
    Gyazo confirms data breach affecting 23.6 million users

    Gyazo confirmed a massive data breach affecting 23.6 million users, exposing usernames, emails, encrypted passwords, and metadata from 490 million files.

  3. [TECHNOLOGY] 5 sources
    Gyazo data breach exposes 23 million user records

    A data breach at Gyazo, operated by Helpfeel, has exposed approximately 23.62 million user records and metadata for 490 million images after attackers exploited an upload server vulnerability.

Sources

compsmag.com · cyberinsider.com · cybernoz.com · cybersecurity-jp.com · defence24.pl · internet.watch.impress.co.jp · itnerd.blog · scan.netsecurity.ne.jp · telepolis.pl

This summary has been updated 1 time: see revision history