Gyazo Breach Exposes 23.6 Million User Records and Hundreds of Millions of Image Metadata Entries

TOKYO (AP) — Gyazo, the popular image-sharing service operated by Helpfeel Inc., confirmed on Wednesday that a significant security breach has compromised the data of approximately 23.62 million users and exposed metadata for nearly half a billion images. The incident, discovered on September 17, 2026, marks one of the largest data exposures in Japan's digital history, affecting both domestic and international accounts.

The company stated that unauthorized access allowed attackers to retrieve user records containing email addresses, passwords, and registration dates. Additionally, metadata associated with 490 million images stored on the platform was accessed. This metadata includes information such as image filenames, upload timestamps, and file sizes. Gyazo emphasized that the actual image content itself was not part of the breach, though the sheer volume of exposed metadata raises concerns regarding user privacy and potential correlation attacks.

Helpfeel Inc., headquartered in Tokyo, has immediately initiated a comprehensive investigation into the incident. The company notified Japanese authorities and relevant regulatory bodies within hours of confirming the scope of the intrusion. As of Wednesday afternoon, no specific threat actor or nation-state group has claimed responsibility for the attack, and the method used to bypass Gyazo's security defenses remains unknown.

The breach impacts a wide range of users who rely on Gyazo for quick image hosting, particularly within developer communities and online forums where the service is frequently utilized. While the company has not yet disclosed whether any financial data was stored or compromised, it has urged all affected users to change their passwords immediately. Gyazo also advised users to enable two-factor authentication where available to secure their accounts against potential credential stuffing attacks.

Security experts note that the exposure of such a vast amount of image metadata could facilitate targeted phishing campaigns or allow malicious actors to map user activity patterns over time. The scale of the data involved suggests a sophisticated operation, though Gyazo has not provided details on whether the breach was the result of an external hack, insider threat, or a vulnerability in third-party integrations.

Helpfeel Inc. announced that it is working with cybersecurity firms to patch the identified vulnerabilities and prevent further unauthorized access. The company plans to provide a detailed timeline of the incident and additional guidance for users in the coming days. Until then, the full extent of the damage remains unclear, as investigators work to determine if any data has been sold on dark web markets or used for malicious purposes.

Questions remain regarding how long the attackers had access to the system before detection and whether similar breaches have occurred at other services operated by Helpfeel. As the investigation continues, Gyazo faces scrutiny over its data protection measures and the speed of its response to the initial intrusion.