Gyazo breach exposes 23.62 million user records and 490 million image records
PII and metadata exposed in huge attack

Date:
Thu, 17 Sep 2026 17:30:00 +0000

Description:
PII, image metadata, and possibly personal images, exposed in a large attack on Helpfeel's image-sharing service.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter Helpfeel confirmed a Sept 11 breach compromising 23.62M records tied to Gyazo users Stolen data includes PII, login/session IDs, Google SSO tokens, and 490M image metadata records Payment info safe, but private images may have been exposed; viewing disabled pending investigation A Japanese customer-support and knowledge-base company suffered a cyberattack recently in which it lost millions of user records, including personally identifiable information (PII) and, possibly, customer photographs.

The company in question is called Helpfeel. It is an established organization with more than 200 employees, operating as a combination of a modern help center, intelligent search, and an AI support agent. It runs an image-sharing service called Gyazo. According to a breach notification published earlier this week, the breach happened on September 11, when an unidentified threat actor abused a vulnerability to upload malware , gain access to the services servers, and run arbitrary commands on them. A subsequent investigation determined that the attacker compromised 23.62 million records. Multiple records are tied to the same user, and many of the records were generated by customers without user accounts, so the actual number of affected individuals is not yet determined (but its definitely less than 23.6 million). Latest Videos From TechRadar Watch full video here: Image metadata exposed, too The compromised records fall into these categories: names, emails, password hashes, user IDs, device IDs, login session IDs, X integration tokens, email addresses associated with Google SSO , profile information, language preferences, registration date and time, login date and time, subscription plan, billing status (without credit card numbers), and usage statistics.

We have confirmed that no payment information, including credit card numbers, was disclosed without authorization, Helpfeel confirmed. You may like Over 9 million facial recognition images leaked in major breach at reverse image search and identity verification service Over 14 million login credentials leaked from six ISPs in major data breach heres what we know Massive data breach sees 220 million traveler records exposed nine years of airline info leaked including passenger and passport details

PII aside, the attackers also accessed image metadata. Roughly 490 million records associated with images registered in or before January 2019 were compromised, including image IDs, source IP address used for the upload, user-agents, EXIF location data, OCR text extracted from the images, image titles, source URLs, and hashed passphrases for private images.

Since some of this metadata is used to generate image URLs, Helpfeel does not rule out the possibility that the attackers viewed actual images, as well. We have temporarily disabled viewing of some images to prevent further harm, it said. As we cannot rule out the possibility that some private images may have been viewed by the third party, we are continuing our detailed investigation. Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

Via The Hacker News The best antivirus for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/gyazo-breach-exposes-23-62-million-user -records-and-490-million-image-records-pii-and-metadata-exposed-in-huge-attack


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)