Helpfeel Inc. (Kyoto, Japan; CEO Isshu Rakusai) confirmed on September 16, 2026 that its image-sharing service Gyazo was compromised by an unauthorized third party who exploited a vulnerability in the image upload server to execute arbitrary commands on company systems and reach the Gyazo database. In its bilingual notice and apology, the company says approximately 23.62 million user records were exfiltrated, alongside roughly 490 million image metadata records plus a further ~2.4 million metadata records the attacker pulled using narrower, targeted criteria. MLex summarized the same disclosure as "about 23.6 million user records" and headlined it as 24 million; Japanese outlets ITmedia and INTERNET Watch, and English coverage from Abijita and BigGo, all carry the company's 23.62 million figure. The variation is rounding of one number, not competing counts. Credit card and payment data were not exposed. Helpfeel reported the incident to Japan's Personal Information Protection Commission on September 15, per ITmedia and MLex.
What Happened
The company's own timeline is unusually tight. On September 11, 2026 (JST), a third party exploited a vulnerability present in Gyazo's image upload server, achieving arbitrary command execution on Helpfeel infrastructure. Helpfeel detected anomalous behavior that same evening and began investigation and response. By the early hours of September 12, it had blocked the identified intrusion routes and severed the attacker's active connections. The underlying vulnerability has since been patched, and the company states all access routes used in the incident are closed.
Subsequent forensic work, described by ITmedia as involving an external specialist firm, established that the intruder had reached the Gyazo database and exfiltrated both user records and image metadata. Helpfeel notified the Personal Information Protection Commission on September 15 and went public on September 16. Helpfeel stresses its investigation is ongoing and that additional facts may emerge; everything below reflects what the company had confirmed as of the September 16 notice.
Helpfeel's other products, the Helpfeel AI knowledge platform and the Cosense team knowledge base, run on separate system architectures, and the company says no data exfiltration from those systems has been confirmed. There is a knock-on effect, though: images hosted on Gyazo and embedded in Helpfeel or Cosense pages may fail to load while Gyazo image delivery is restricted.
What Was Taken
Two distinct data sets, with two distinct risk profiles.
User records: approximately 23.62 million. Fields include the user-specified name or nickname (an arbitrary string), email address, password hash, user ID, device ID, login session ID, X (formerly Twitter) integration token where linked, Google SSO email address where linked, profile information, interface language, registration timestamp, last login timestamp, subscription plan, billing status, and usage statistics. Helpfeel is explicit that card numbers and other payment details are not in scope. Field coverage varies per account.
Critically, 23.62 million is a count of records, not people. The set includes anonymous accounts with no registered email address, and Helpfeel says it is still determining how many individuals actually had personal data exposed. The Japanese aggregator Real-time News NAVI frames the figure as "the entire user base scale," which is an inference rather than a company statement; treat it as such.
Image metadata: approximately 490 million records, plus ~2.4 million. The bulk relates mainly to images registered on or before January 2019, which Helpfeel quantifies as roughly 14.4 percent of all image-related data. A separate batch of about 2.4 million metadata records was retrieved by the attacker under narrowed conditions, suggesting deliberate selection rather than bulk scraping alone. Exposed metadata fields: image ID (the component that forms the image URL), upload source IP address, User-Agent string, EXIF geolocation where present in the file, OCR-extracted text from the image, image title, source URL, and hashed passphrases for private images.
Helpfeel has confirmed that a file listing of private images was obtained. It says it cannot completely rule out that some private images were viewed by the third party, and that no loss or destruction of image data has been found so far.
Why It Matters
The metadata is arguably worse than the credential dump, and that inverts the usual triage instinct.
Gyazo's model issues a unique, unguessable URL per capture, and access control for non-public images has historically leaned on that URL being secret. Once image IDs leak, the secret-URL model collapses: anyone holding the list can construct working URLs. Helpfeel acknowledges this directly and has temporarily disabled viewing of some affected images as a containment measure. This is the structural lesson for defenders: capability-URL access control degrades to zero the moment the capability itself is in a database an attacker reaches. It is not defense in depth; it is a single factor with no revocation story until you invalidate the URLs.
The OCR text field compounds the exposure. Gyazo users screenshot what is in front of them: dashboards, ticket queues, config files, private chats, credentials, internal documents. OCR text in the leak means an attacker can search 490 million images by their textual content without ever fetching an image, turning an opaque metadata dump into a keyword-searchable index of whatever people captured. Combine that with upload-source IP and EXIF geolocation and you have a corporate and personal attribution set.
On the account side, live login session IDs and X integration tokens are immediately actionable credentials, not hashes that need cracking. Helpfeel says it reviewed the specification and abuse potential of the leaked authentication data and has already carried out the necessary invalidation and restriction measures. Password hashes remain a cross-service credential stuffing risk, which is why the company is urging password changes on Gyazo and anywhere the same or a similar password is reused.
Helpfeel's detection-to-containment gap was measured in hours, not months, which deserves credit. The disclosure is also unusually specific by the standards of Japanese incident notices, naming exact field lists and percentages rather than hiding behind "some customer information."
The Attack Technique
Helpfeel attributes the intrusion to a vulnerability in Gyazo's image upload server that permitted execution of arbitrary commands on internal systems, then lateral access to the Gyazo database. In ATT&CK terms this reads as Exploit Public-Facing Application leading to command execution and then collection from a data store. The company has not published a CVE, a vulnerability class, or any details about the specific flaw, nor has it named or characterized the actor. No attribution, no ransom demand, and no claim of extortion appears in any of the sources.
Image upload endpoints are a recurring weak point for exactly the reasons visible here: they accept untrusted binary input, invoke parsers and transformation pipelines (resize, thumbnail, EXIF strip, OCR), and often run those pipelines on hosts with database reachability. Any of those steps is a candidate for the flaw, but no source states which, and the specifics remain unconfirmed.
One contextual note: Real-time News NAVI observes that Gyazo was not an isolated case in September 2026, citing an unauthorized access disclosure by Murauchi.com affecting roughly 7,716,811 personal data records. That claim appears in a single lower-tier source and is not corroborated here; treat it as unverified context.
What Organizations Should Do
- Rotate Gyazo credentials and revoke linked accounts now. Change your Gyazo password, and change it anywhere you reused it or used a near-variant. If you linked X or Google SSO to Gyazo, revoke and reissue those app authorizations yourself rather than trusting that Helpfeel's invalidation covered your token.
- Audit what your organization actually screenshotted. Anyone who used Gyazo for work should assume image IDs, titles, and OCR text for pre-2019 captures are in third-party hands. Search your own history for captures containing API keys, tokens, internal URLs, dashboards, or customer data, and treat every secret visible in one as compromised and requiring rotation.
- Stop treating unguessable URLs as an access control. Inventory every system where "the link is the permission" (capture tools, file shares, signed download links, invite URLs). Add a real authorization check at fetch time, or at minimum make those URLs expire and be revocable in bulk.
- Isolate upload and media-processing infrastructure from data stores. Hosts that parse untrusted files should not hold credentials that reach a production user database. Segment the network path, scope the service account to write-only object storage, and assume the parser will eventually be exploited.
- Strip metadata at ingest, not at display. EXIF geolocation and source IP are liabilities the moment they are persisted. Discard what you do not need before it lands in a table. The same applies to OCR text: if you retain it, classify and protect it as user content, because that is what it is.
- Add session-invalidation to your breach playbook and test it. Leaked session IDs are usable immediately. Confirm you can mass-revoke sessions and OAuth tokens across every integration in minutes, and that revocation is verifiably enforced server-side rather than relying on client-side expiry.
Sources: Notice and Apology Regarding a Data Breach Resulting from Unauthori... | 「Gyazo」への不正アクセスによる情報漏えいに関するお知らせとお詫び | Gyazo Data Breach Exposes 23.6 Million User Records and Image Metadata | Japan's Gyazo Suffers Data Breach: 23.62 Million User Records and 4... | Gyazo不正アクセス、2362万件はなぜ全ユーザー規模なのか - リアルタイムニュースNAVI | Gyazoに不正アクセス ユーザー情報約2362万件、画像メタデータ約4.9億件が流出｜Infoseekニュース | 画像共有サービス「Gyazo」に不正アクセス、ユーザー情報約2362万件・画像メタデータ約4.9億件が漏えい - INTERNET W... | Japan's Helpfeel says Gyazo data breach exposed 24m user records M...