Gyazo Breach Exposes 23.62 Million User Records and 490 Million Image Metadata Records
Summary: Helpfeel, the Kyoto-based operator of image-sharing service Gyazo, disclosed a breach in which an attacker exploited a vulnerability in Gyazo's image upload server to run arbitrary commands and access its database, exposing about 23.62 million user records including email addresses and password hashes and about 490 million image metadata records. The metadata, mostly for images registered in January 2019 or earlier, included the 32-character image IDs that form Gyazo links, which Helpfeel said could be used to view images without permission; the company noticed suspicious activity on the evening of September 11 Japan time, fixed the flaw the same day, confirmed data exposure on September 14, and published its notice on September 16.
What you should know: Gyazo's help pages state that for a capture at the default setting the link is the only thing protecting it, and the leaked image IDs are the part that makes that link unguessable - so roughly 490 million metadata records now carry the keys to images users believed were private until shared. Helpfeel also said it cannot rule out that the third party viewed some private images, and has not said whether the exposed session IDs remain valid.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026