What happened
Helpfeel, the Kyoto company behind the screenshot tool Gyazo, said that on September 11, 2026 an attacker exploited a vulnerability in its image upload server, ran arbitrary commands and reached its database. The activity was spotted that evening and access was cut off by the next morning.
What was exposed
In its September 16 notice, the company confirmed:
- about 23.62 million user records: names or nicknames, email addresses, password hashes, device and session IDs and X integration tokens;
- about 490 million image metadata records, mostly for images uploaded up to January 2019: upload IP, EXIF location, OCR-extracted text and the IDs used to build image URLs.
Because of that last field, Helpfeel paused image viewing. No payment data was exposed.
The September 25 update added that about 18.01 million records (~76%) belong to anonymous accounts with no email, and that metadata for about 174 million images users had already deleted, mostly up to February 2023, was exposed too. The deleted files themselves were not. The vulnerability and attacker have not been named.
Why it matters
It is a data retention problem: users deleted images years ago, but the metadata (including location and image text) stayed on the server.
What to do now
- Gyazo users: change your password and revoke the X integration in your X account settings.
- Companies: check whether internal screenshots went to Gyazo; OCR text may contain sensitive data.
- Review your own policy: "delete" must also delete metadata and indexes.