Gyazo, the image-sharing service operated by Kyoto-based Helpfeel Inc., confirmed a data breach exposing approximately 23.62 million user records and 490 million image metadata records. The incident, disclosed in a notice published Wednesday, involved the exposure of email addresses, password hashes, and image link IDs. The company stated it is investigating the incident and implementing security measures.

What should defenders do?

Users should practice credential hygiene, use unique passwords, enable multi-factor authentication where available, and monitor accounts for suspicious activity. Helpfeel is advised to conduct a full investigation, enforce access controls, and transparently communicate remediation steps.

highData Breaches

Gyazo Data Breach Exposes 23.62 Million User Records and 490 Million Image Metadata Records

Helpfeel Inc. confirms exposure of user PII and image link IDs; investigation underway

CyberIntel DeskPublished 11 days agoUpdated less than a minute ago1 min read

Gyazo Data Breach Exposes 23.62 Million User Records and 490 Million Image Metadata Records

Key Takeaways

Gyazo (Helpfeel Inc.) confirmed a data breach exposing 23.62 million user records and 490 million image metadata records.
Exposed data includes email addresses, password hashes, and image link IDs from images dating to January 2019 or earlier.
The incident is classified as a data exposure event; no specific CVE or software patch has been issued.

Related Security News

highData Breaches

Times Car Confirms Data Breach Affecting 6.6 Million User Accounts

Times Car, a Japanese car-sharing service, has confirmed a data breach compromising approximately 6.6 million user accounts. The incident was disclosed late last week, with the exact attack vector and nature of exposed personal information yet to be fully specified. Authorities and the company are reportedly investigating the breach.

BleepingComputerabout 4 hours ago1 min read

highdata-breaches

French Tax Administration Data Breach Exposed Hundreds of Thousands of Records via Stolen Staff Credentials

An unauthorized access incident at France's Direction Générale des Finances Publiques (DGPP) compromised tax data belonging to hundreds of thousands of taxpayers and businesses between June and July 2026. According to a report published by France's national cybersecurity agency ANSSI on 29 September 2026, the attacker used stolen staff passwords to gain entry. The agency stated the attack was 'not sophisticated' and went undetected for seven weeks due to weak security controls. ANSSI noted that neither the tax administration nor the agency itself observed data exfiltration, though the breach resulted in unauthorized access to sensitive fiscal information.

The Hacker Newsabout 5 hours ago1 min read