Gyazo's Breach Leaked 23 Million Accounts and 490 Million Image Links Anyone Can Open

Helpfeel confirmed that attackers broke into Gyazo's image-upload server, ran their own commands, and walked out with the database.

About 23.62 million user records and 490 million image metadata records left with them, Helpfeel said. Payment cards were not in the dump. No attacker has been named.

Gyazo is Helpfeel's screenshot and screen-recording cloud, popular in gaming. The company claims about 23 million users and 3.1 billion media items.

The exposed user records include anonymous accounts with no registered email. Fields can include name or nickname, email, password hash, user, device, and session IDs, an X (Twitter) integration token if the account was connected, a Google SSO email if connected, profile, language, registration and last login times, subscription plan, billing status with no credit card numbers, and usage statistics. Helpfeel is still working out how many identified people sit behind those records. A count that includes anonymous accounts is not the same as 23.62 million identified people.

About 490 million image metadata records were also taken, mostly for images from January 2019 or earlier, about 14.4 percent of image-related data. A further 2.4 million records were pulled through a separate filter. Helpfeel has not said whether those sets overlap.

The dump included OCR text extracted from captures, EXIF location if present, and X integration tokens for connected accounts, plus image IDs that rebuild public URLs, upload IP, User-Agent, title, source URL, and hashed passphrases for private images. Those IDs can be used to view images without permission. Helpfeel temporarily disabled viewing of some affected images.

The attacker also obtained a list identifying private images. Helpfeel said it cannot rule out that some private images were viewed. The company has found no evidence image data was deleted. Helpfeel and Cosense run on separate systems, and no exposure was found there.

Helpfeel noticed suspicious activity on the evening of 11 September, Japan time, then blocked the access routes and fixed the vulnerability in the early hours of 12 September. It confirmed exposure on 14 September, reported the incident to Japan's Personal Information Protection Commission on 15 September, and published the notice on 16 September. Earlier public notices framed loading failures as maintenance or emergency maintenance.

X integration tokens in a screenshot dump sit in the same token-theft lane as Hacktron's path into OpenAI source code, another case where a connected account token was part of the haul.

Some offers on this page may be paid placements or contain affiliate links.