[REVISION HISTORY]
Gyazo data breach
Updated 1 time since CLSTR started tracking revisions of this situation.
What changed
2026-09-21 07:29 UTC → 2026-09-28 01:21 UTC ·
added
removed
Kyoto-based Helpfeel Inc., the operator of the image-sharing service Gyazo, reported a major data breach following unauthorized access on September 11, 2026. Attackers exploited a vulnerability in the service’s image upload server to execute malicious commands and access backend systems. The breach exposed approximately 23.6 million user records. Compromised information includes names, email addresses, password hashes, user and device IDs, X integration tokens, Google SSO email addresses, profile details, and subscription information. While the company clarified that credit card numbers and payment-method information were not affected, attackers also accessed metadata associated with roughly 490 million images and videos, primarily those uploaded before January 2019. Recent reports confirm the scope of the metadata exposure includes IP addresses, EXIF location data, and OCR text. Helpfeel Inc. has noted that its other services, Helpfeel and Cosense, remain unaffected by the breach, though some images displayed via Gyazo may be temporarily unavailable. In response to the incident, Gyazo temporarily suspended certain services to perform maintenance and patch the security flaw. The company stated that it has since blocked the access routes, remediated the vulnerability, and is conducting further investigations with external experts.
Versions
Only revisions since CLSTR began indexing content versions appear here. Select a version to see what changed compared to the one before it.