Helpfeel said on September 16 that an attacker took the image IDs behind Gyazo share links, the only thing protecting a capture at its default setting, along with 23.62 million user records. Private images may also have been viewed.
What to Know?
- Helpfeel confirmed an attacker took 23.62 million user records, including email addresses, password hashes and session IDs.
- Image metadata for about 490 million captures was also taken, including the IDs used to build Gyazo image links.
- Gyazo’s help pages call those links “unguessable,” and the leaked IDs are what made them hard to guess.
- Helpfeel cannot rule out that a third party viewed some private images, and has blocked viewing of some.
- Gyazo users should change their Gyazo password now, plus any password they reused elsewhere.
How It Happened?
The attacker exploited a vulnerability in Gyazo’s image upload server, ran arbitrary commands on Helpfeel’s systems, and reached the Gyazo database, the Kyoto-based company said in its breach notice. Helpfeel has not said what kind of flaw it was.
Helpfeel spotted suspicious activity on the evening of September 11, Japan time, and says it cut the attacker’s access and patched the hole within hours. It confirmed the exposure three days later, reported it to Japan’s Personal Information Protection Commission, and published its notice the day after. Gyazo’s product updates page called the resulting outage “emergency maintenance” and did not mention a breach. It ranks among the larger cases in the 2026 data breach tracker.
Following our previous announcement regarding emergency maintenance for Gyazo, we have published an update regarding unauthorized access.
— Gyazo (@gyazo) September 16, 2026
We apologize for the inconvenience and concern this may have caused.
For more details: https://t.co/0wnbWnC9tC pic.twitter.com/DohMGeT3Hl
The Link Was the Lock
Every Gyazo capture gets a URL built from a 32-character image ID, and for a capture left at the default setting that URL is the whole access control. Gyazo says a capture stays private until its link is shared, and anyone holding that link can then see it. Free accounts can browse only their 10 most recent captures, yet Gyazo says older ones are never deleted and stay reachable by URL.
The metadata covers mostly images registered in or before January 2019, about 14.4% of Helpfeel’s image-related data, plus a separate pull of 2.4 million images selected by unstated filtering criteria. Records can carry the upload IP address, User-Agent, EXIF location data, image titles, a hashed passphrase for password-locked images, and the OCR text Gyazo extracts from paid users’ captures. Gyazo’s OCR page tells those users, “Only you can see OCR results.“
What Helpfeel Has Not Said?
Helpfeel found no loss of image data and says outside specialists are still working. The attacker did obtain a list identifying private images, which is why the company cannot rule out that some were opened. Nothing released shows any specific image was viewed.
Four gaps remain:
- Which vulnerability was used, and whether the leaked session IDs still work?
- What the “specific filtering criteria” selected, and whether that 2.4 million overlaps the larger set?
- Which images are currently blocked, whether they are the “Only me” kind or the password-locked kind, and how a user can check their own?
- How many people sit behind the record count, which Helpfeel says includes anonymous accounts?
The Bottom Line
A leaked password hash forces one action. A leaked image ID cannot be rotated: the URL is the secret, and the only fix is to stop serving the image, which Helpfeel has done for an unnamed subset. Years of work notes, dashboards and chat windows people captured and half-forgot were guarded by a string that has now been copied. Credential hygiene is the easier half here, and reuse stays the weak point across password statistics.
What’s next: Helpfeel plans to email affected users it can identify and to post notices in the Gyazo interface for anonymous accounts, with the forensic review still open. Users can reduce risk today by changing their Gyazo password and every reuse of it, revoking the X integration token on linked accounts, signing out of active sessions, and treating any link shared before 2019 as public. Deleting sensitive old captures is the only step that ends the exposure.
