Japan's Gyazo Suffers Data Breach: 23.62 Million User Records and 490 Million Image ...

Helpfeel, the operator of the image-sharing service Gyazo, announced on September 16 that unauthorized access by a third party resulted in the external leak of approximately 23.62 million user records and roughly 490 million metadata entries related to uploaded images. The attacker is believed to have exploited a vulnerability in the image upload server to execute arbitrary commands on internal systems.

The company began investigation and response immediately upon detecting the anomalous behavior, completing the blocking of the intrusion route and disconnection of access by September 12. Subsequent forensic investigation confirmed the large-scale data breach.

Scope of Leaked Information

The user information confirmed to have been leaked includes names (arbitrary strings such as user-specified full names or nicknames), email addresses, password hash values, user IDs, device IDs, and login session IDs, as well as authentication-related information spanning a wide range, including X (formerly Twitter) integration tokens and Google SSO email addresses (where applicable).

Additionally, profile information, language preferences, registration timestamps, last login timestamps, subscription plans, billing status, and usage statistics are also included. The company noted that billing status does not contain payment information such as card numbers.

Regarding image-related metadata, the breach covers image IDs (information constituting image URLs), upload source IP addresses, User-Agent strings, EXIF location data (where embedded in images), OCR text extracted from images, image titles, and source URLs. Approximately 490 million entries were leaked, representing 14.4% of all data related to images registered before January 2019.

Notably, passphrases for private images (in hashed form) were also among the leaked data. Helpfeel explained that it cannot completely rule out the possibility that private images were viewed by third parties.

Note: Figures are based on Helpfeel's announcement as of September 16, 2026. The types and scope of leaked information vary by user, and details remain under investigation.

Response Status and Impact on Users

Helpfeel has already completed the review and invalidation or restriction of leaked authentication-related information. Additionally, from the perspective of preventing secondary damage, the company has temporarily disabled viewing of certain images.

Going forward, the company plans to send individual notifications to potentially affected users via their registered email addresses. It is also advising users to change their passwords and urging them to exercise caution regarding suspicious emails or messages related to this breach.

Gyazo has been widely used, particularly among developers and designers, due to its ease of sharing screen captures with a single click. Its characteristic feature is storing image data such as screenshots, GIFs, and videos in the cloud and sharing them via URLs, and it is frequently used for work-related information sharing.

The potential exposure of private images is particularly serious in this breach. Gyazo allows users to set images as public or private on a per-image basis, with private images accessible only to those who know the URL. However, with the leak of hashed passphrases, there is a risk that private images could be viewed if the hashes are somehow recovered.

Furthermore, the leak of X integration tokens suggests the possibility that attackers could gain unauthorized access to users' X accounts. Helpfeel is proceeding with invalidation of the affected tokens, but users who utilized the integration feature should consider revoking app connections and changing passwords on the X side as well.

The leak of EXIF location data also cannot be overlooked. Images captured on smartphones and other devices may have latitude and longitude of the shooting location embedded, and when combined with image IDs and OCR text, this raises concerns the identification of users' movement history and whereabouts.

Helpfeel is continuing its investigation, and since the types and scope of leaked information vary by user, determining the full extent of impact is expected to take time. According to the company's announcement, no specific reports of financial damage or secondary harm have been confirmed at this time, but users are being urged to remain vigilant against suspicious communications.

This incident shakes confidence in the security posture of image-sharing services and could have implications for other providers offering similar services. In particular, the simultaneous leak of authentication credentials and image metadata goes beyond a simple personal information breach, representing a situation that could infringe on user privacy in multiple dimensions, and the results of the ongoing investigation will be closely watched.

Once added, BigGo Finance appears first in Google Top Stories, so you get the broadest, most up-to-the-minute, and most comprehensive global financial news first.