Helpfeel: Gyazo Upload Server Flaw Exposes 23.62 Million User Records

"Helpfeel Inc., the Kyoto-based operator of the Gyazo screenshot and screen-recording service, has confirmed that an unidentified third party exploited a vulnerability in Gyazo's image upload server on September 11…"

Helpfeel Inc., the Kyoto-based operator of the Gyazo screenshot and screen-recording service, has confirmed that an unidentified third party exploited a vulnerability in Gyazo's image upload server on September 11, 2026. The attacker ran arbitrary commands and reached the Gyazo database. According to Helpfeel's own notices, the attacker took about 23.62 million user records and about 490 million image metadata records. They also pulled about 2.4 million more metadata records using narrower filtering criteria. On September 25, Helpfeel said it had found that another roughly 174 million metadata records tied to images users had already deleted were also exposed. iSec News calculates that this brings total exposed metadata to about 664 million records. Every outlet reviewed uses the same user record figure. MLex's "24 million" headline rounds the company's 23.62 million and is not a competing count. Helpfeel says no credit card or payment data was exposed, and no threat actor has been named.

What Happened

The core timeline is consistent across Helpfeel's notices and secondary coverage. All times are JST:

September 11 (evening): The attacker exploits the upload server flaw and gets command execution on Helpfeel infrastructure. Helpfeel detects unusual activity the same evening and starts its response (Wasteland, ThreatPaper, Threadlinqs).
Early September 12: Helpfeel blocks the intrusion routes, cuts the attacker's active connections and fixes the vulnerability (Bright Defense, ThreatPaper).
September 14: Helpfeel confirms that data was stolen (ThreatPaper).
September 15: Helpfeel reports the incident to Japan's Personal Information Protection Commission (PPC). ThreatPaper reports this, and Wasteland reports it citing ITmedia and MLex.
September 16: Helpfeel publishes its first public notice. Helpfeel's September 25 update calls this the "First Notice," and Wasteland, Threadlinqs and ThreatPaper give the same date. ForensicPost dates the disclosure to September 18, which appears to reflect when it published or reviewed the notice. The company's own reference points to September 16.
September 25 (Update 2): Helpfeel discloses the newly found 174 million deleted-image metadata records and breaks down the user records by type.
September 27: Gyazo service resumes after a precautionary suspension. All images uploaded before the intrusion are set to owner-only viewing.
September 29: For Gyazo Teams only, Helpfeel lets other team members view images whose delivery is suspended. Images set to "Only me" stay private, and password-protected images still need the password.

Helpfeel says external specialists are still investigating. ITmedia, as cited by Wasteland, reports that an outside forensic firm is involved.

What Was Taken

User records: about 23.62 million. Helpfeel says this is a count of records, not people, because one person can hold several rows. The company has not published a figure for affected individuals and says it is still working one out. Of the 23.62 million, about 18.01 million belong to anonymous accounts with no registered email and about 5.62 million belong to users with a registered email (Helpfeel Update 2, iSec News). ThreatPaper and Threadlinqs list the fields as follows. Not every field applies to every account:

Names or nicknames, and email addresses
Password hashes
User IDs, device IDs and login session IDs
X (Twitter) integration tokens, and email addresses used for Google sign-in
Profile and language settings, registration and last-login timestamps
Subscription plan, billing status and usage statistics

Image metadata: about 490 million records, mainly for images uploaded in or before January 2019, plus about 2.4 million records pulled with targeted filtering criteria. Threadlinqs gives a combined total of about 492.4 million, which matches 490 million plus 2.4 million. ForensicPost and Threadlinqs report that the metadata includes image identifiers, uploader IP addresses, EXIF data (including location where the file carried it) and text extracted from images by OCR. Threadlinqs alone reports that it also includes hashed passphrases for password-protected images.

Deleted-image metadata: about 174 million records, mainly for images deleted in or before February 2023. Helpfeel says the deleted image files themselves were not exposed and are currently inaccessible.

Not exposed: Credit card numbers and other payment details, according to Helpfeel.

As of Helpfeel's September 25 update, the company had not confirmed any misuse of the data. Helpfeel says it invalidated OAuth integration credentials as a precaution. It also says its investigation found that the stolen X integration tokens cannot, on their own, be used to log in to or control X accounts.

Why It Matters

The user records get the headlines, but ForensicPost and ThreatPaper both argue that the image metadata is the bigger risk. ForensicPost says Gyazo images are effectively "private by obscurity": the image identifier forms the shareable link. If that is right, anyone holding the metadata table could build working URLs to hundreds of millions of screenshots, read the OCR text Gyazo extracted from them, and in some cases see where the uploader was. This is ForensicPost's analysis, and Helpfeel has not confirmed it. However, Helpfeel's decision to make every pre-incident image owner-only on resumption fits a concern that links could be reconstructed.

For businesses, the issue is what people screenshot. Screenshots often capture internal dashboards, credentials, customer records, source code, chat threads and configuration consoles. OCR text makes that content searchable at scale, so an attacker does not need to open each image to find valuable ones. Any organization whose staff used Gyazo, officially or not, should assume screenshots of internal systems may now be indexable by a third party.

The exposure of deleted-image metadata also shows that "delete" did not mean deleted. Records for content users removed as far back as early 2023 were still in the breached database.

The Attack Technique

Helpfeel describes the cause only as a vulnerability in Gyazo's image upload server that let the attacker execute arbitrary commands. It has not disclosed the flaw class, and no CVE has been referenced. Threadlinqs cites The Hacker News and other roundups describing a critical server-side flaw in the upload component. Threadlinqs suggests this is consistent with unsafe file handling or input validation, but that is analyst inference, not something Helpfeel has confirmed. Threadlinqs maps the incident to MITRE ATT&CK techniques including T1059 (Command and Scripting Interpreter), T1078 (Valid Accounts) and T1110.004 (Credential Stuffing). The last two most likely describe follow-on risk from the stolen data rather than how the attacker got in.

The pattern is a familiar one: a public-facing component that accepts user-supplied files is compromised, the attacker moves from command execution to the backing database, and bulk data is taken within hours. Helpfeel's detection and containment were fast, inside one evening and the early hours of the next day, but the data had already left. Attribution confidence is low and no group has claimed the attack.

What Organizations Should Do

Inventory Gyazo use. Check proxy and DNS logs for gyazo.com traffic to find employees who used the service. Treat any internal screenshots they uploaded, especially pre-2019 uploads covered by the main metadata set, as potentially exposed. Rotate any credentials, API keys or tokens that may have been visible in those images.
Force credential hygiene. Have affected users change their Gyazo password and any reused passwords elsewhere. Watch for credential stuffing against corporate SSO and SaaS logins, and enforce phishing-resistant MFA.
Review OAuth grants. Helpfeel has invalidated integration tokens, but security teams should still audit X and Google third-party app connections tied to corporate identities and revoke stale Gyazo grants.
Prepare for targeted phishing. Email addresses combined with subscription status and Gyazo context are ideal material for convincing "Gyazo security notice" lures. Brief staff and tune mail filters.
Harden your own upload paths. Run file-handling services in isolated, low-privilege sandboxes with no direct database credentials. Validate content type and structure server-side, strip EXIF data on ingest, and alert on child-process creation from upload workers.
Set policy on screenshot tools. Move staff to sanctioned tools with access-controlled sharing rather than unguessable-URL models. Require that real deletion and data retention limits are in the vendor contract.

Sources: Gyazo Breach Exposes 23.62 Million User Records | Notice and Apology Regarding a Data Breach Resulting from Unauthori... | Notice Regarding the Resumption of Gyazo Services | Helpfeel Finds 174 Million Deleted Gyazo Metadata Records Exposed –... | Gyazo Server Flaw Exploited to Take 23.6 Million User Records and 4... | Helpfeel: Gyazo Breached Through Image Upload Server Vulnerability... | Gyazo Data Breach — Threat Intelligence Threadlinqs | Gyazo breach: 23.6M user records and 490M image-metadata records —...