Gyazo Data Breach Exposes 23.6 Million User Records

Helpfeel, the Japanese company operating the Gyazo image-sharing platform, has confirmed a major data breach that exposed approximately 23.62 million user records and 490 million image metadata records. The breach occurred on September 11, 2026, when attackers exploited a vulnerability in the service's image upload server to gain unauthorized access to its database. According to Helpfeel's disclosure, the company detected suspicious activity on the evening of September 11, Japan time, and by the early hours of September 12, it had blocked the access routes, terminated the attacker's connections, and fixed the vulnerability. However, the data had already been stolen. The exposed user records include names, email addresses, password hashes, user IDs, device IDs, login session IDs, X integration tokens, Google SSO email addresses, profile information, language preferences, registration and last login dates, subscription plans, billing status, and usage statistics. Helpfeel emphasized that no payment card data was compromised, and the records include anonymous accounts without registered email addresses.