The Gyazo image-sharing platform suffered a major data breach on September 11, 2026, after an attacker exploited an upload server vulnerability to execute arbitrary commands and infiltrate backend systems. Kyoto-based operator Helpfeel Inc. confirmed the incident exposed approximately 23.62 million user-related records and metadata linked to roughly 490 million images.
Anatomy of the Upload Server Exploit
The breach began when malicious actors located and exploited a specific flaw inside Gyazo’s upload server architecture. According to disclosures from Helpfeel Inc., this vulnerability allowed the attacker to execute arbitrary commands directly on the server level. Once inside, the intruder accessed backend systems to read database tables containing core application data.
https://x.com/gyazo_ja/status/2100825600835694640
Suspicious activity was flagged internally on the evening of September 11. Engineering teams moved swiftly. By the early hours of September 12, Helpfeel administrators had successfully blocked the active access routes, severed the attacker’s sessions, and patched the vulnerable entry point. The company formally confirmed the data theft on September 14, alerting users and subsequently notifying Japan’s Personal Information Protection Commission on September 15.
Scope of the Exposure: User Records and Image Metadata
The data extracted by the attacker spans two massive repositories. The first consists of 23.62 million user-related records. Helpfeel stressed that this figure includes anonymous accounts, meaning the total does not necessarily represent the same number of identifiable individuals.
The exposed user records feature a wide variety of profile data fields:
- User names or nicknames
- Email addresses and Google SSO email addresses
- Password hashes
- User and device IDs alongside login session IDs
- X integration tokens
- Profile details, subscription and billing status
- Login timestamps and usage statistics
Crucially, Helpfeel confirmed that no credit card numbers or other direct payment-method information were exposed during the breach. However, the second major category of stolen data involves approximately 490 million image metadata records. Primarily covering media registered in or before January 2019—representing roughly 14.4% of Gyazo’s image-related data—this cache holds significant privacy risks.
An additional 2.4 million image metadata entries were specifically retrieved using targeted filtering criteria. This metadata trove contains image IDs, upload IP addresses, User-Agent strings, EXIF location data, OCR-extracted text, image titles, source URLs, and hashed passphrases utilized for private image protection.
URL Construction Risks and Service Suspension
The exposure of hundreds of millions of image IDs introduces a critical downstream vulnerability. Because Gyazo URLs can be directly constructed using these image IDs, the stolen metadata enables unauthorized third parties to discover and view corresponding images hosted on the platform.
To stanch potential data leakage, Helpfeel temporarily suspended select image delivery functions and later took the broader step of halting the platform entirely. As announced via the official Gyazo X account on September 18, 2026:
“We have temporarily suspended the Gyazo service as a precautionary measure for maintenance. We sincerely apologize for the inconvenience and appreciate your patience while we work to restore service.”
External forensic specialists are continuing to investigate the breach. While Helpfeel operates other platforms such as its namesake knowledge-management service and Cosense, the company verified that those systems use different architectures and have not shown evidence of compromise.
Remediation Steps for End-Users
External forensic investigations are ongoing, but immediate user action is required to mitigate secondary risks. Because password hashes and email identifiers were compromised, threat actors can leverage credentials against other third-party services where users share identical login credentials.
Security analysts advise taking the following precautions:
- Change Passwords Immediately: Update credentials on Gyazo and any external account sharing similar login details.
- Watch for Phishing Campaigns: Exercise heightened caution regarding incoming emails or direct messages exploiting exposed profile, account, or image-related information.
- Audit Private Uploads: Review potentially sensitive Gyazo uploads that may have been affected.
As Helpfeel coordinates with regulatory bodies like Japan’s Personal Information Protection Commission, users must remain vigilant against targeted social engineering tactics while awaiting a secure platform restoration.
