Helpfeel, the Japanese company behind the popular image-sharing service Gyazo, has disclosed a major security incident in which attackers exploited a vulnerability in Gyazo's image upload server and gained unauthorized access to the service's systems.
According to Helpfeel's September 16 disclosure, approximately 23.62 million user-related records were exposed, along with metadata associated with approximately 490 million images. The investigation is still ongoing, and Helpfeel says additional information may emerge.
Importantly, the 23.62 million figure represents records, not confirmed individual users. Helpfeel says the dataset includes anonymous accounts and other records that may not correspond one-to-one with individual people.
What happened?
On September 11, 2026, a third party exploited a vulnerability in Gyazo's image upload server.
Helpfeel says the vulnerability allowed the attacker to gain unauthorized access and execute arbitrary commands on Gyazo's systems.
The company detected suspicious activity that evening and blocked the identified access routes by the early hours of September 12. It also remediated the exploited vulnerability.
Helpfeel subsequently determined that the attackers had accessed the Gyazo database and that user information and image-related metadata had been disclosed without authorization.
The company has not publicly identified a CVE for the vulnerability, and its disclosure does not provide enough technical information to determine the exact vulnerability class.
What information was exposed?
The affected user records can contain different types of information depending on the account.
Helpfeel says the exposed data may include:
- Names or user-provided profile text
- Email addresses
- Password hashes
- User IDs
- Device IDs
- Login session IDs
- Profile information
- Registration and login timestamps
- Subscription plans
- Billing status
- Usage statistics
- Google SSO email addresses, where connected
- X integration tokens, where connected
Helpfeel specifically confirmed that credit-card numbers and other payment information were not exposed.
The exposure of password hashes is nevertheless significant. Helpfeel says it has reviewed the authentication-related information involved and implemented measures including invalidation and restrictions where appropriate.
The company is also asking all Gyazo users to change their passwords, particularly if the same or a similar password was used elsewhere.
490 million image metadata records
The incident goes beyond account information.
Helpfeel says approximately 490 million image metadata records, primarily associated with images registered in or before January 2019, were exposed.
The metadata can include:
- Image IDs used to construct image URLs
- Upload IP addresses
- User-Agent information
- EXIF location information
- OCR-extracted text
- Image titles
- Source URLs
- Hashed passphrases for private images
An additional approximately 2.4 million image metadata records were obtained using separate filtering criteria.
This creates a particularly important privacy concern.
Because some exposed metadata can be used to construct Gyazo image URLs, Helpfeel says it cannot rule out unauthorized access to some images. The company also confirmed that attackers obtained a list identifying private images.
At the same time, Helpfeel says its investigation has not confirmed the loss of the image files themselves. Some image viewing was temporarily disabled as a precaution while the investigation continued.
Why the image metadata matters
For an image-sharing platform, metadata can be almost as important as the image itself.
A screenshot may contain:
- Internal company information
- Customer information
- Source code
- Credentials accidentally captured on screen
- Documents
- Personal information
- Geographic information
- Internal URLs or infrastructure details
Even when an attacker does not obtain the original image file, exposed metadata such as OCR text, source IP addresses, image URLs and EXIF information can provide useful intelligence.
The possibility that private image URLs could be reconstructed adds another layer of risk.
Were other Helpfeel services affected?
Helpfeel says its Helpfeel and Cosense services use separate system architectures and that the investigation had not found unauthorized access or information disclosure from those systems as of September 16.
However, some images embedded in those services may temporarily have been unavailable because Gyazo image delivery was suspended.
Helpfeel announced that it was also conducting an emergency security review of those services as a precaution.
What should Gyazo users do?
Helpfeel recommends that Gyazo users take immediate precautions.
✅ Change your Gyazo password
This is the most important immediate step.
If the same or a similar password was used on another service, change that password there as well.
✅ Review accounts connected to Gyazo
Users who connected Google SSO or X should pay particular attention to their accounts because related authentication or integration information may be among the exposed data.
✅ Be alert for targeted phishing
The combination of email addresses, profile information and historical usage information can make future phishing attempts more convincing.
Be particularly cautious about messages claiming to be from:
- Gyazo
- Helpfeel
- X
- Security teams
- Payment providers
Do not enter credentials through links received unexpectedly.
✅ Treat old shared images carefully
If sensitive information was previously shared through Gyazo, companies and users should review older links and consider whether any exposed content should be replaced or removed.
✅ Companies should review password reuse
If employees used Gyazo credentials elsewhere, the incident should be treated as a potential credential exposure event and included in internal password and identity-security reviews.
The bigger cybersecurity lesson
The Gyazo incident demonstrates how a vulnerability in a seemingly narrow component — in this case, an image upload server — can become a much larger security problem.
The initial weakness was in the upload infrastructure, but the resulting access reached databases containing user information and large quantities of image metadata.
It also highlights why security teams need to look beyond simple database protection.
A modern application may expose sensitive information through:
Upload service → application server → database → authentication data → stored content → metadata
A compromise at the first stage can potentially provide a path toward the others.
The incident also shows why metadata deserves the same attention as primary data. IP addresses, OCR text, URLs, EXIF information and authentication identifiers can provide substantial value to an attacker even when payment information is completely isolated.
What companies can learn from the incident
Companies operating file, image or content-sharing platforms should consider:
- Strict isolation of upload-processing infrastructure
- Sandboxing of uploaded content
- Least-privilege database access
- Strong separation between upload servers and core databases
- Short-lived authentication tokens
- Rapid invalidation capabilities
- Monitoring for abnormal command execution
- Detection of unusual database access
- Protection of metadata as sensitive information
- Regular security testing of upload and processing endpoints
- Review of old stored content and metadata
- Clear incident-response procedures for authentication compromise
For users, the lesson is simpler: never assume that a service storing screenshots or images contains only harmless data.
Screenshots frequently contain credentials, customer information, internal systems and other sensitive material.
Final thoughts
The Gyazo breach is significant not only because of the number of records involved, but because of the type of information exposed. User credentials, session identifiers, integration tokens and hundreds of millions of image metadata records can provide attackers with valuable information for follow-up attacks.
Helpfeel says it has fixed the exploited vulnerability, blocked the access routes used in the incident and is continuing a forensic investigation with external specialists. The company is also notifying potentially affected users as the investigation progresses.
A vulnerability in one internet-facing service can expose far more than the service itself. Upload infrastructure, authentication data and metadata all need to be treated as part of the security boundary.
