Helpfeel, the Japanese software company behind the Gyazo image-sharing service, has confirmed a data breach that exposed approximately 23.62 million user records. The unauthorized access occurred on September 11, 2026, when an attacker exploited a vulnerability in Gyazo's image upload server, allowing them to execute malicious commands.
The company stated that the attacker was blocked from their systems the following day, September 12, but had already accessed a database containing user information. The compromised data includes names or nicknames, email addresses, password hashes, user IDs, device IDs, login session IDs, X integration tokens, Google SSO email addresses, profile information, language preferences, registration and last login dates/times, subscription plans, billing status, and usage statistics. Helpfeel explicitly confirmed that no payment card information, such as credit card numbers, was exposed. The breach also affected anonymous accounts that did not have registered email addresses.
In addition to user records, the incident also led to the exposure of approximately 490 million image metadata records, predominantly for images uploaded in or before January 2019. Metadata from an additional 2.4 million images was also accessed through specific search queries. This metadata could include image IDs, upload IP addresses, User-Agent data, EXIF location information, OCR text, image titles, source URLs, other general metadata, and hashed passphrases for private images.
Helpfeel acknowledged that some of this exposed metadata could potentially be used to reconstruct Gyazo image URLs, which might allow unauthorized access to images. While the company has not confirmed that image files themselves were stolen, it cannot rule out the possibility that some private images were viewed. As a precautionary measure, access to certain images has been temporarily disabled. A list of private images was also obtained by the attacker.
The company is in the process of notifying affected Gyazo users via their registered email addresses. For users without registered email addresses, such as those with anonymous accounts, notifications will be provided through the Gyazo web interface. Helpfeel has confirmed that all access routes used in the incident have been blocked and the exploited vulnerability has been remediated.
Helpfeel is advising all Gyazo users to change their passwords immediately, especially if they use the same or similar passwords on other online services. Users are also encouraged to remain vigilant for suspicious emails, messages, or other communications that could be phishing attempts designed to exploit the breach. The investigation into the incident is ongoing, and Helpfeel has stated it will publish updates if further information emerges. No unauthorized disclosure has been confirmed in Helpfeel's or Cosense's other systems.
