Gyazo's breach exposed the 32-character image IDs that were the only protection on older captures
Helpfeel says an attacker took about 490 million Gyazo image metadata records, including the IDs that build every capture link, and the company has disabled viewing of some images and asked every user to change their password.
The Watch · Security desk
What happened
- Helpfeel says the attacker exploited a vulnerability in Gyazo's image upload server, ran arbitrary commands on its systems and reached the Gyazo database; it has not said what kind of flaw it was.
- About 23.62 million user records were exposed, including email addresses and password hashes, according to the Kyoto company's notice published Wednesday.
- About 490 million image metadata records were also exposed, mostly for images registered in January 2019 or earlier, including the IDs that make up Gyazo image links.
Why it matters
- Who's exposed exposure A default Gyazo capture is protected by nothing but its link, so whoever holds the metadata set can pull images uploaded years ago by accounts that have not logged in since.
- What it limits constraint The one action Helpfeel asked of users does not reach the exposure: passwords rotate, image IDs do not, and a free account can see only its 10 most recent captures on the site to prune the older ones.
- What's now possible capability Because each image ID sits beside OCR text taken from inside the capture, an attacker can pick targets by keyword before requesting a single URL.
- What doesn't add up contradiction Gyazo's help pages still tell users a capture link "can't be guessed," while Helpfeel's own notice says the leaked IDs can be used to view images without permission.
Next story · Security · 9h ago
Burger King Japan app breach reached 11.18 million customer records over six daysConfirmed2 publishers
Every Gyazo capture link is built from a 32-character image ID. Gyazo's help pages say a capture stays private until its link is shared, that anyone holding the link can see it, and that the ID is long enough that a link "can't be guessed" [18]. At the default setting the link is the only thing protecting the file, and the leaked records hold the part of the link that made it unguessable [19].
The set can be filtered before anything is fetched. Helpfeel's list of exposed metadata fields includes the image ID, the upload IP address, the User-Agent, EXIF location data where the image carried it, the image title, the source URL, and OCR text extracted from the image [10]. That OCR text comes from a paid feature users switch on themselves, which then scans every image on the account [17]. Search the dump for a hostname, then request only the URLs that match. Retrieval is an ordinary GET against a live link.
Helpfeel put the affected records at about 14.4% of its image-related data [9]. That makes the full set roughly 3.4 billion records [21]. The affected ones are mostly images registered in January 2019 or earlier [2]. Metadata for a further 2.4 million images was pulled using what the company called "specific filtering criteria" [13].
Helpfeel asked every Gyazo user to change their password, and to change it anywhere else the same or a similar one is in use [5]. That closes the account. It does nothing to a 2018 capture whose ID is in the dump and whose URL still resolves. A free account can browse only its 10 most recent captures on Gyazo's site, and Gyazo says older captures are not deleted and stay reachable by anyone with the URL [20].
The attacker also obtained a list identifying private images. Helpfeel said it "cannot rule out the possibility that the third party may have viewed some private images" [11]. On Gyazo a private capture is either one set to "Only me," which the help pages say cannot be viewed even by someone who knows the link, or one locked with a password, and both settings are paid-plan only [12]. The exposed metadata fields include a hashed passphrase for private images [10].
On the credential side, the user records can include device IDs, login session IDs, X integration tokens and the email address used for Google single sign-on [7]. Helpfeel said it reviewed the exposed authentication data and took "the necessary measures, including invalidation and restrictions" [15]. Gyazo's verification code for logins from a new IP address is a login-time check [16]. No payment card data was exposed [8].
The company did not say which images it disabled, what the second filter selected for, which authentication items it invalidated, or whether the exposed session IDs remain valid [3][13][15][16].
The 23.62 million figure counts records, not people. It includes anonymous accounts with no registered email address, and Helpfeel said it is still working out how many people had personal information exposed [6].
What to watch
- Whether Helpfeel identifies the upload-server flaw and the dates the attacker had command execution.
- Whether the 2.4 million records pulled with "specific filtering criteria" include images newer than January 2019.
- Whether Helpfeel gives users a way to check which of their captures are in the affected sets, and when the disabled images come back online.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence70
- Adoption60
- Hype gap+20
- Incentives55
- Confidence65
Perspective Coverage
6 publishers- Builder
- Builder 23%
- Operator
- Operator 67%
- Investor
- Investor 10%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Helpfeel, the Kyoto-based operator of image-sharing service Gyazo, said in a notice published Wednesday that a security breach exposed about 23.62 million user records, including email addresses and password hashes.
- [2]
The breach also exposed about 490 million image metadata records, mostly for images from January 2019 or earlier, including the IDs that make up Gyazo image links.
- [3]
Helpfeel said the exposed image IDs could be used to view the images without permission, and that it has temporarily disabled viewing of some of them to prevent further harm; it did not say which images are disabled or how a user can tell whether their captures are in the affected sets.
- [4]
Helpfeel said the attacker gained access through a vulnerability in Gyazo's image upload server, ran arbitrary commands on Helpfeel's systems and accessed Gyazo's database; the company has not said what kind of flaw it was.
- [5]
Helpfeel asked every Gyazo user to change their password and to change it on any other service that uses the same or a similar one, and to watch for suspicious emails or messages related to the incident.
- [6]
The 23.62 million figure counts records; Helpfeel said they include anonymous accounts with no registered email address and that it is still working out how many people had their personal information exposed.
- [7]
Exposed user records can include name text, email address, password hash, user ID, device ID, login session ID, X integration token if connected, the email address used for Google single sign-on if connected, profile information, language preference, registration and last login times, subscription plan, billing status, and usage statistics; the fields present vary from user to user.
- [8]
Helpfeel said no payment information, including credit card numbers, was exposed.
- [9]
Helpfeel said the affected metadata records make up about 14.4% of its image-related data.
- [10]
Helpfeel listed the exposed image metadata fields as image ID (the information used to build the image URL), the IP address used for the upload, User-Agent, EXIF location data if present, OCR text extracted from the image, image title, source URL and other metadata, and a hashed passphrase for private images.
- [11]
Helpfeel said the attacker also obtained a list identifying private images and that it "cannot rule out the possibility that the third party may have viewed some private images."
- [12]
On Gyazo a private capture can mean one set to "Only me," which the help pages say cannot be viewed even by someone who knows the link, or one locked with a password; both settings are available only on paid plans, and Helpfeel has not said which it means or how such images could have been viewed.
- [13]
Metadata for a further 2.4 million images was pulled separately using what Helpfeel called "specific filtering criteria"; the company has not said what the filter was, whether the two sets overlap, or whether the second set includes newer images.
- [14]
Helpfeel said its investigation has not found any loss of image data.
- [15]
Helpfeel said it has reviewed the exposed authentication data and taken "the necessary measures, including invalidation and restrictions"; it did not say which items were invalidated.
- [16]
Gyazo normally emails a verification code when a login comes from a new IP address, a check that runs at login; Helpfeel has not said whether the exposed session IDs remain valid.
- [17]
Gyazo's OCR text field comes from a paid feature that users enable themselves and that then scans all of the account's images, letting them search the text in their captures.
- [18]
Every Gyazo capture gets a link built from a 32-character image ID, and Gyazo's help pages say a capture stays private until its link is shared, that anyone who has the link can see it, and that the ID is long enough that a link "can't be guessed."
- [19]
For a capture at the default setting, the link is the only thing protecting it, and the leaked image IDs are the part of the link that makes it unguessable.
- [20]
Free Gyazo accounts can browse only their 10 most recent captures on Gyazo's site, but Gyazo says older captures are not deleted and remain accessible to anyone with the URL.
- [21]
If the 490 million affected image metadata records are about 14.4% of Helpfeel's image-related data, the full set is roughly 3.4 billion records.
Sources
6 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comGyazo server flaw exploited to steal 23.6 million user records
1 article · September 18, 2026
- helpnetsecurity.comHackers exploit Gyazo server flaw to steal 23.6 million user records
1 article · September 21, 2026
- infosecurity-magazine.comExperts Alarmed Over Gyazo’s Breach of 490 Million Metadata Records
1 article · September 21, 2026
- securityaffairs.comGyazo Data Breach Exposes 23 Million User Records
1 article · September 18, 2026
- securityweek.com23 Million User Records Compromised in Gyazo Data Breach
1 article · September 18, 2026
- thehackernews.comGyazo Breach Exposes 23.62 Million User Records and 490 Million Image Metadata Records
1 article · September 17, 2026
Topics and entities
Topics
- Unguessable link access control
- Image metadata privacy
- Data Breaches