A third party exploited a vulnerability in Gyazo's image-upload server to gain arbitrary command execution and database access, exposing 23.62 million user records and 490 million image-metadata records including the private-image access IDs (Helpfeel Inc., 2026-09-16).
Coverage
1
first 2026-09-18 → last 2026-09-30
Latest activity
2026-09-18
Helpfeel's 'unguessable link' privacy model for Gyazo collapsed once the image IDs themselves leaked from the…
Peak priority
routine
1 routine
Targets
technology
sectors: technology · regions: apac
Sources cited
2
2 hosts
Defender insights
What each entry about Gyazo (Helpfeel) data breach (September 2026) tells a defender to do, newest first.
1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)
Initial AccessExploit Public-Facing Application
Initial Access TA0001
T1190Exploit Public-Facing Application×1
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Helpfeel Inc. (Kyoto, Japan) disclosed on 2026-09-16 that on 2026-09-11 a third party exploited a vulnerability in the image-upload server of Gyazo, its screenshot-sharing service, executed arbitrary commands and accessed Gyazo's database (Helpfeel Inc., 2026-09-16). Helpfeel has not named the flaw class (The Hacker News, 2026-09-17). About 23.62 million user records were exposed, including email addresses, password hashes and login session IDs, together with about 490 million image-metadata records, mostly for images registered in or before January 2019, that include the image IDs used to build Gyazo image links (Helpfeel Inc., 2026-09-16). A capture at Gyazo's default setting is protected only by its link, so the leaked image IDs remove that protection (The Hacker News, 2026-09-17). Helpfeel says the attacker also obtained a list identifying private images and that it cannot rule out that some of them were viewed (Helpfeel Inc., 2026-09-16).
On September 11, 2026, a third party exploited a vulnerability in Gyazo's image upload server to gain unauthorized access to our systems and execute arbitrary commands.
We have also confirmed that the third party obtained a list identifying private images. As we cannot rule out the possibility that some private images may have been viewed by the third party, we are continuing our detailed investigation.
Helpfeel lists an X (formerly Twitter) integration token and the email address associated with Google single sign-on among the exposed user fields, not a Google SSO token (Helpfeel Inc., 2026-09-16). For a capture at Gyazo's default setting, the link is the only protection, so the leaked image IDs remove it. Captures set to "Only me" cannot be viewed even by someone who knows the link, according to Gyazo's help pages as reported by The Hacker News (The Hacker News, 2026-09-17).