Helpfeel Inc., the company behind the image sharing service Gyazo, disclosed on September 16, 2026 that an unauthorized third party accessed its systems and leaked roughly 23.62 million user records. Around 490 million image metadata entries were also taken, including the values that make up image URLs. The intrusion routes have been cut off and the underlying vulnerability patched, but the company is asking users to change their passwords.
It Started With a Vulnerability in the Image Upload Server
The intrusion happened on September 11, 2026. An attacker exploited a vulnerability in Gyazo's image upload server that allowed arbitrary commands to be executed on Helpfeel's systems. Arbitrary command execution means the attacker could operate the server freely, which places this incident among the more serious classes of compromise.
Helpfeel detected the suspicious activity that same night and, by the early hours of September 12, had blocked the confirmed intrusion routes and severed the unauthorized connections. The vulnerability that caused the breach was patched at that point. Subsequent investigation revealed that the attacker had reached Gyazo's database and exfiltrated data.
The timeline up to disclosure looks like this.
| Date | Action |
|---|---|
| September 11 | Unauthorized access detected, investigation begins |
| September 12 | Initial response completed, vulnerability patched |
| September 14 | Data exfiltration confirmed, image delivery suspended as a precaution |
| September 15 | Additional measures taken, report filed with the Personal Information Protection Commission |
| September 16 | Confirmed scope of the leak made public |
Five days from detection to disclosure is a reasonable pace for incident response. That said, two of those days sit between the September 14 confirmation of exfiltration and the public announcement, and what happened in that window will have to wait for follow-up reporting.
Session IDs and Linked-Account Tokens Are in the Leaked Data
About 23.62 million user records were confirmed as leaked. The fields involved are wide ranging: names, email addresses, password hash values, user IDs, device IDs, login session IDs, X (formerly Twitter) integration tokens, Google SSO email addresses, profile information, language settings, registration timestamps, last login timestamps, subscription plans, billing status and usage statistics. Payment details such as credit card numbers were confirmed as not included.
The entries worth worrying about here are the login session IDs and X integration tokens rather than the password hashes. Hashes take effort to crack, but session IDs and access tokens function as keys in their own right for as long as they remain valid. Helpfeel says it reviewed the specifications and abuse potential of the leaked authentication data and has already invalidated or restricted it as needed.
The figure of 23.62 million also includes anonymous accounts registered without an email address. The number of people actually affected in terms of personal data is therefore expected to be lower, and identifying that figure is still in progress.
The 490 Million Metadata Entries Are Harder to Assess
The second leak covers roughly 490 million image metadata entries. These relate mainly to images registered before January 2019, amounting to about 14.4 percent of all image data. A separate, narrower set covering around 2.4 million images was also taken.
The metadata includes image IDs, upload source IP addresses, User-Agent strings, EXIF location data where present, OCR text extracted from images, image titles and source URLs. Passphrases for private images were also included, in hashed form.
The problem is that the image ID is the value that makes up the image URL. On a service where knowing the URL is enough to view the file, leaking the ID effectively grants access to the image itself. To limit secondary damage, Helpfeel temporarily disabled viewing for some images and resumed delivery only for images uploaded after the fix was complete. The company has also confirmed that a file listing of private images was obtained, and it cannot entirely rule out that some private images were viewed by a third party.
The presence of OCR text deserves attention as well. Gyazo built its following on capturing and sharing screenshots in a single action, which means work screens and fragments of chat logs were routinely pasted into it. If the contents of those images survive as readable text, the metadata alone could reveal a considerable amount.
Helpfeel's other products, Helpfeel and Cosense, run on separate system architectures, and no data leak from them has been confirmed. Images served through Gyazo inside those products may be unavailable, however, because of the suspension of image delivery.
What Users Can Do
Helpfeel plans to contact potentially affected users individually through their registered email addresses. For anonymous accounts and others who cannot be reached by email, notices will be shown inside the service itself.
The first step for users is changing their Gyazo password. Anyone reusing that password, or a similar one, on other services should change those as well. With password hashes in circulation, they can be cracked over time and fed into credential stuffing attacks against other sites.
Suspicious emails and messages riding on the incident are the other concern. Because email addresses were leaked, phishing messages impersonating Gyazo notices are a realistic possibility. Password changes should be made by visiting the service directly rather than following links inside an email.
If you have uploaded work related screenshots to Gyazo in the past, it is worth reviewing their visibility settings and clearing out anything you no longer need to keep.
Summary
The Gyazo breach involves roughly 23.62 million user records and about 490 million image metadata entries, and what sets it apart is that the leaked data includes the values used to build image URLs. Payment information was not exposed, but session IDs, integration tokens and potential access to private images are all difficult categories to contain. Helpfeel has engaged an external forensics firm and has committed to reviewing its authentication and authorization design along with strengthening monitoring. For users, the practical response is to change passwords, stop reusing them across services, and watch for follow-up announcements.
