Breach · · 6 min read
Gyazo’s final report: the database was read. Most images were not.
Helpfeel’s October 21 report says logs show a large transfer, but not what was inside it. About 5.6 million of the accounts had an email. 432 images were taken.
Helpfeel, the company behind the screenshot tool Gyazo, published its final investigation on October 21, 2026. A bug in Gyazo’s own upload server let someone run commands, read the database, and send a large amount of data to an outside server. The break-in ran from the afternoon of September 11 into the early hours of September 12, Japan time. Helpfeel had blocked that route by then and patched the bug the same morning.
This was not a supplier’s software. Helpfeel says the bug was in code it wrote and ran: input on the server that converts uploaded videos was treated as a command.
What the logs can and cannot show
The outside investigators compared server and cloud logs. Those logs show large reads from the database, and a large transfer from the same server to one outside server, in the same window. They do not record the contents of that transfer. Helpfeel says it is not possible to name, from the logs alone, the exact fields or the exact number of records that left.
The investigators’ assessment was that data probably did leave. The counts below are the scope Helpfeel states from that investigation and its own. They are not a manifest of the transfer. Helpfeel also says rounding means the pieces may not add up to the totals.
| What | Count | What Helpfeel says about it |
|---|---|---|
| User records | About 23.62 million | Accounts, not people. About 18.01 million had no email. About 5.62 million did. |
| Image metadata | About 490 million | Mostly images uploaded in or before January 2019, about 14.4% of all images. Metadata, not the image files. |
| Metadata pulled with filters | About 2.4 million | About 0.07% of all images. |
| Metadata for deleted images | About 174 million | Mostly images deleted in or before February 2023, or accounts deleted by then. About 5.1% of all images. |
| Image files | 432 files | Specific images belonging to 133 users. Those users have been emailed. |
The field list for the user records is the one in the September 16 notice, and it still varies by account. It includes a name or nickname if the person typed one, email address, a password hash, user ID, device ID, login session ID, an X integration token if that account was connected, the email on a connected Google sign-in, profile text, language, registration and last login times, subscription plan, billing status, and usage statistics. Billing status does not include a card number. No payment information, including credit card numbers, was in the disclosed set.
The October 21 report adds a correction on the hashes. They are a one-way transform, not the passwords. The passwords themselves were not disclosed. Helpfeel says it has already invalidated the authentication data and the external-service connections it believes were exposed, and that this data alone should no longer open an account.
On the image files, the investigators found no record of a large download, and no record that deleted images’ files were taken. Helpfeel then found that 432 images, from 133 users, were viewed or taken. It has written to those users about which images. It also cannot rule out someone opening an image by using a URL that was sitting in the metadata. That is why images uploaded before the break-in stay visible only to the owner, until that person reviews them and turns delivery back on. Helpfeel says it will not flip them all back on by itself. Images in Gyazo Teams can still be seen by other people on the same team.
The 133 users’ images did not, Helpfeel says, contain its own customers’ information from the Helpfeel or Cosense products. Those two products run on different systems. The review found no disclosure and no unauthorized access there.
Deleted images kept their metadata
When someone deleted an image, Gyazo deleted the file after a while and kept the metadata, for misuse investigations and for requests from authorities. The breach included a large set of that leftover metadata.
Helpfeel’s new rule is that metadata for a deleted image will be deleted automatically 60 days after the image is deleted. Older metadata, including metadata touched by this incident, will be deleted over time, except where a report to an authority or a law says to keep it. It will also set retention periods for records tied to deleted accounts, and publish those periods in its privacy policy.
What Helpfeel has and has not seen since
As of October 20, Helpfeel had not confirmed misuse, impersonation, financial loss, or other harm from the incident. Since late September it has been watching illicit marketplaces, including what it calls the dark web, and as of October 20 it had not found this data offered there. It will keep watching for at least a year.
It reported a preliminary finding to Japan’s Personal Information Protection Commission on September 15 and a follow-up on September 24, and it still owes that commission a final report. It has been reporting to the Ministry of Internal Affairs and Communications since September 16. It has notified privacy regulators in about 30 countries and regions, including under the GDPR. It has consulted the Kyoto Prefectural Police. The service itself came back on September 27.
What to do
- If you have not changed your Gyazo password since September 11, change it. That is Helpfeel’s request, including if you think the hash alone is useless. If you used the same or a similar password anywhere else, change those too.
- Do not treat a Helpfeel email as a link to click. Mail about this incident will not ask you to open a URL or do something on a linked site. Helpfeel will not ask for your password or your card number because of this incident. The Gyazo contact page, if you need it, is help.gyazo.com/contact-us. Open it yourself.
- Look at screenshots you uploaded before September 11 before you turn sharing back on. Helpfeel is leaving that choice with you because a URL in the metadata may still point at the image. A screenshot can show a password, a private message, or an account page. The company has not said the 432 known images contained those. The review is still yours.
- No email does not mean no record. About three quarters of the user records had no email address. Helpfeel has been writing, since September 20, to addresses it does have. It is now also writing to about 57,000 accounts, including deleted and cancelled ones, that had an address and may be tied to the deleted-image metadata. Everyone else will not get a letter, because there is nowhere to send it.
- A card on the Gyazo account was not part of this. If a message asks for one, it is not Helpfeel’s notice.
Sources
- Helpfeel, Notice Regarding Unauthorized Access to Gyazo: Investigation Results (Update 3), October 21, 2026
- Helpfeel, Notice and Apology Regarding a Data Breach Resulting from Unauthorized Access to Gyazo, September 16, 2026
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.