Helpfeel, the Japanese company behind the image-sharing service Gyazo, confirmed on September 16 that an attacker exploited a flaw in Gyazo’s image upload server to run commands on the company’s systems and pull data from Gyazo’s database. The unauthorized access happened on September 11; Helpfeel detected suspicious activity that evening and had blocked the access routes by early the next morning. The exposure is large by any measure: roughly 23.62 million user records, including names, email addresses, password hashes, device and session IDs, and SSO tokens, plus around 490 million image metadata records for pictures uploaded through January 2019, some carrying EXIF location data and OCR-extracted text. Helpfeel says payment information and credit card numbers were not exposed, and reported the incident to Japan’s Personal Information Protection Commission on September 15.
Why it matters: the breach chain here, a flaw in a file-upload server leading to full database access, is one of the most common breach patterns in 2026, and it worked here against a service with hundreds of millions of stored images. The metadata exposure is arguably the more consequential half of this breach for affected users: EXIF location data and OCR text pulled from years of uploaded screenshots can reconstruct far more about a person’s habits and communications than a leaked password hash, which can simply be rotated.
The original insight is that this breach again shows why upload-processing pipelines need the same isolation discipline as authentication systems. Helpfeel’s own account frames the entry point as command execution from the upload server, the same structural pattern this site has tracked in CenterPoint Energy’s customer data exposure and the single-device compromise that reached Florida’s DMV database: a narrow entry point reaching a database that was never supposed to be one hop away.
Teams running services that accept file uploads should confirm the processing pipeline is isolated from direct database credentials and audit what metadata gets retained from uploads versus what is actually needed; affected Gyazo users should rotate any password shared with other services.
Source: Helpfeel
