Breaches and incidentsBriefReported by a reputable outlet, citing the company
Gyazo: server vulnerability exploited, 23.6 million user records and 490 million image metadata records taken
Gyazo (Helpfeel) confirmed a third party accessed its database on 11 Sep 2026.
- Disclosed
What happened
- Gyazo (Helpfeel) confirmed a third party accessed its database on 11 Sep 2026: about 23.62 million user records (names, emails, password hashes, session IDs, X integration tokens, Google SSO emails, billing status) and 490 million image metadata records (upload IPs, EXIF location, OCR text, hashed private-image passphrases), plus a list identifying private images.
- Root cause: a “server vulnerability”, fixed; no technical detail.
- No attacker named.
- Service taken offline; users and authorities notified.
Sources
- https://www.bleepingcomputer.com/news/security/gyazo-server-flaw-exploited-to-steal-236-million-user-records/
- https://www.cm-alliance.com/cybersecurity-blog/major-cyber-attacks-data-breaches-ransomware-attacks-september-2026
- https://thehackernews.com/2026/09/gyazo-breach-exposes-2362-million-user.html
- https://corp.helpfeel.com/en/news/news-20260916
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.