Gyazo Breach Exposes 23.62 Million User Records and 490 Million Image Metadata Records

Gyazo is a widely used image capture and sharing service operated by Helpfeel Inc., a company headquartered in Kyoto, Japan, that also builds help center software, intelligent search tools and an artificial intelligence support agent. Gyazo lets people grab screenshots, record short screen videos and upload images, then share them through links built from a unique image identifier. The service is popular among developers, designers and support teams because a capture can be shared instantly with a single URL.

On September 16, 2026, Helpfeel published a notice and apology confirming that Gyazo had suffered unauthorized access by a third party. According to the notice, an attacker exploited a vulnerability in Gyazo's image upload server on September 11, 2026, and used it to execute arbitrary commands on the company's systems. The intrusion exposed approximately 23.62 million records containing Gyazo user data and roughly 490 million records of image metadata, making it one of the largest data breaches reported in Japan's technology sector this year.

Helpfeel said it detected suspicious activity on the evening of September 11 and, by the early hours of September 12, had blocked the identified access routes and terminated the unauthorized connections. The company confirmed on September 14 that data had been stolen, reported the incident to Japan's Personal Information Protection Commission on September 15, and issued its public notice the following day. Investigators also confirmed that the attacker had accessed Gyazo's database.

The exposed user records include names or nicknames, email addresses, password hashes, user identifiers, device identifiers, login session identifiers, X integration tokens, Google single sign-on email addresses, profile information, language preferences, registration and last login timestamps, subscription plan details, billing status and usage statistics. The separate image metadata covers primarily images registered in or before January 2019 and includes image identifiers used to construct Gyazo URLs, source upload IP addresses, User-Agent strings, EXIF location data, OCR text extracted from images, image titles, source URLs and hashed passphrases for private images.

Key Facts

Helpfeel said on September 16 that approximately 23.62 million records containing Gyazo user data were disclosed without authorization. The company stressed that the figure counts records rather than people, because multiple records can belong to the same user and many records were generated by customers who never registered an account. The number of affected individuals is therefore lower than 23.62 million, and Helpfeel said it was still determining exactly how many people had personal information exposed.

The Hacker News reported on September 17 that the breach also exposed about 490 million image metadata records, mostly for images registered in January 2019 or earlier. That affected metadata represents roughly 14.4 percent of Helpfeel's image-related data, and metadata for about 2.4 million additional images was retrieved using specific filtering criteria. Helpfeel confirmed that no payment information, including credit card numbers, was exposed.

CyberInsider reported on September 18 that Helpfeel confirmed the data theft on September 14 and subsequently suspended some image delivery. Gyazo then announced a temporary service suspension in a post on X on September 18, 2026. The same report noted that by the early hours of September 12 the company had blocked access routes, terminated the attacker's connections and remediated the exploited vulnerability.

TechRadar Pro reported on September 17 that Helpfeel is an established organization with more than 200 employees that operates a help center, intelligent search and an AI support agent alongside Gyazo. An unidentified threat actor abused a vulnerability to upload malware, gain access to the service's servers and run arbitrary commands. Because some metadata is used to generate image URLs, Helpfeel does not rule out that attackers viewed actual images, and the company temporarily disabled viewing of some content.

Helpfeel asked every Gyazo user to change their password and to change it on any other service that uses the same or a similar password, and to watch for suspicious emails or messages. The company said it reviewed the exposed authentication data and took necessary measures including invalidation and restrictions, but did not specify which items were invalidated. Every Gyazo capture gets a link built from a 32-character image identifier, and Gyazo's help pages state that a capture stays private until its link is shared and that anyone with the link can see it.

Analysis

The scale of this breach is best understood by separating the two data sets. The 23.62 million user records contain identity, authentication and billing-related fields, which makes them valuable for credential stuffing, phishing and account takeover campaigns. The 490 million image metadata records are different in kind: they are not credentials, but they are a map. Image identifiers can be turned into working Gyazo URLs, and the metadata also includes upload IP addresses, User-Agent strings, EXIF location data and OCR text. What this really means is that the stolen metadata is not merely a privacy problem, it is an access problem, because it can point an attacker directly at images that were never meant to be public.

Helpfeel's own notice acknowledges this risk. The company said that because image IDs can construct Gyazo URLs, a third party could access and view corresponding images without authorization, and it temporarily disabled viewing of some images. It also confirmed that the third party obtained a list identifying private images and cannot rule out that some private images were viewed. Hashed passphrases for private images were included in the exposed metadata, which raises the possibility that poorly protected private images could be unlocked if the hashing method is weak or the passphrases are simple.

Another important detail is the age of the exposed image metadata. Helpfeel said the roughly 490 million records relate primarily to images registered in or before January 2019 and make up about 14.4 percent of all image-related data, with an additional 2.4 million image records retrieved separately using specific filtering criteria. That concentration in older content suggests the attacker either targeted or was able to reach a historical data store that may have lacked the same protections as newer systems. The bigger picture here is that legacy data treated as low risk because it is old can become the most damaging part of a breach when it includes identifiers that still resolve to live content.

The incident also highlights a structural tension in link-based sharing. Gyazo's model treats a capture as private until its link is shared, and anyone with the link can see it. That design works when the identifier is secret and unguessable, but once a large set of image identifiers is stolen, secrecy collapses. The 32-character image ID is a long value, so random guessing was never realistic, but a bulk disclosure changes the threat model entirely and turns a link-based privacy promise into a single point of failure.

Why It Matters

For Gyazo users, the practical consequences are immediate and personal. Anyone who reused their Gyazo password elsewhere should assume that credential is compromised, because password hashes and email addresses were exposed together. Exposed X integration tokens and Google SSO email addresses could help attackers craft convincing phishing messages or attempt unauthorized access to linked accounts. Users should also consider that images from 2019 or earlier may now be reachable through stolen identifiers.

For Helpfeel, the breach is a reputational and operational test. The company is based in Kyoto, employs more than 200 people, and sells help center, intelligent search and AI support products to business customers, so a serious security failure at its consumer-facing image service can affect trust across its entire portfolio. The vulnerability was in an image upload server, a component that processes untrusted files directly, which underscores how file-handling endpoints remain a frequent entry point for attackers.

The episode also matters for the wider technology industry in Japan and beyond. Japan's Personal Information Protection Commission was notified on September 15, and regulators will likely examine how long the company retained image metadata, how private image passphrases were protected, and whether historical stores received the same security attention as current systems. The case adds to a growing list of incidents where metadata, rather than core records, creates the most difficult remediation work because it cannot simply be invalidated like a password.

Next Up

Helpfeel said its detailed investigation continues, particularly into whether any private images were actually viewed. Gyazo's temporary service suspension, announced on X on September 18, 2026, and the partial disabling of image viewing will remain in place while the company assesses the exposure. Users should watch for further guidance from Helpfeel about which authentication items were invalidated, whether exposed login session identifiers remain valid, and when full image delivery will resume.

Regulators, customers and security researchers will also be watching for the technical details of the exploited upload server vulnerability, which Helpfeel has not yet described. Until those details and a final count of affected individuals are published, the full impact of the breach will remain uncertain, and the incident will serve as a reminder that protecting image services means protecting both the accounts that use them and the identifiers that make their content reachable.