2026 Gyazo (Helpfeel) — upload-server RCE; ~23.62M user records + ~490M image metadata
Data compromised
User records (~23.62M; includes anonymous accounts): names/nicknames, emails, password hashes, user/device/session IDs, X/Google SSO tokens where connected, profile/language/plan/billing-status (no card numbers), usage stats. Image metadata (~490M primarily pre–Jan 2019 + ~2.4M filtered): image IDs/URLs, upload IPs, User-Agents, EXIF location, OCR text, titles, source URLs, hashed private-image passphrases
Technical writeup
Verified Helpfeel Inc. notice — September 16, 2026 (JST). On Sep 11 a third party exploited a Gyazo image-upload server vulnerability, executed arbitrary commands, and accessed the Gyazo database. Helpfeel blocked routes overnight Sep 11–12, remediated the vuln, reported to Japan’s Personal Information Protection Commission on Sep 15, and published scope on Sep 16: ~23.62 million user-related records (not yet equated to unique people; includes anonymous accounts) and ~490 million image-metadata records (mostly images registered by Jan 2019, ~14.4% of image-related data) plus ~2.4 million filtered metadata pulls. Payment card numbers not disclosed. Auth tokens invalidated/restricted. Image delivery suspended while investigating private-image URL exposure risk. recordsAffected 23620000 (company record count); companyConfirmed true.
Root cause
Vulnerability in Gyazo image-upload server abused to run arbitrary commands and access the database (Sep 11, 2026)
References
- https://corp.helpfeel.com/en/news/news-20260916
- https://thehackernews.com/2026/09/gyazo-breach-exposes-2362-million-user.html
- https://www.techradar.com/pro/security/gyazo-breach-exposes-23-62-million-user-records-and-490-million-image-records-pii-and-metadata-exposed-in-huge-attack
- https://databreaches.net/2026/09/17/gyazo-breach-exposes-23-62-million-user-records-and-490-million-image-metadata-records/