Helpfeel says hackers accessed Gyazo’s database on Sept. 11, but the company described resulting outages only as maintenance until confirming the breach publicly five days later
Kyoto-based Gyazo, the screenshot-sharing service owned by Helpfeel, said hackers breached its database on Sept. 11 and accessed roughly 23.62 million user records and about 490 million pieces of image metadata, an intrusion the company did not publicly disclose as a security incident until Sept. 16.
Helpfeel said it detected suspicious activity the evening of Sept. 11, Japan time, and had blocked the identified access routes, cut the attacker’s connections and fixed the exploited vulnerability by the early hours of Sept. 12. The company said the attacker exploited a flaw in Gyazo’s image upload server to run arbitrary commands on its systems and access Gyazo’s database; it has not disclosed what kind of vulnerability was involved.
While investigating, Gyazo told users that image loading problems beginning Sept. 14 were due to “emergency maintenance” without mentioning a breach. Helpfeel said it confirmed that data had been exposed on Sept. 14, reported the incident to Japan’s Personal Information Protection Commission on Sept. 15, and published its public breach notice on Sept. 16.
The roughly 23.62 million exposed user records may include names, email addresses, password hashes, user and device IDs, login session IDs, X integration tokens and Google single sign-on emails where applicable, along with profile information, subscription and billing status, and usage statistics; the company said no payment information such as credit card numbers was exposed. Helpfeel said the count includes anonymous accounts with no registered email and that it is still determining how many individuals were affected, since the fields exposed vary by user.
The roughly 490 million leaked image metadata entries include image IDs, upload IP addresses, User-Agent strings, EXIF location data, OCR text extracted from images, image titles, source URLs and hashed passphrases protecting private images. Most of the affected records are for images uploaded before January 2019, representing about 14.4 per cent of Helpfeel’s image-related data; metadata for another 2.4 million images was separately pulled using unspecified filtering criteria, and Helpfeel has not said whether the two sets overlap.
Each Gyazo capture is normally protected only by an unguessable 32-character image ID embedded in its link, and Helpfeel said the exposed image IDs undermine that protection. The company said the attacker also obtained a list identifying private images and that it cannot rule out that some private images were viewed. It has temporarily disabled viewing of certain images as a precaution and said its investigation has not found any loss of image data, though it has not said which images remain disabled or whether exposed login session IDs are still valid.
Helpfeel is asking all Gyazo users to change their passwords, including on any other accounts using the same password, and said it will email affected users with registered addresses while notifying others through the Gyazo website. The company said its Helpfeel and Cosense products run on separate systems and were not affected, though Gyazo images embedded in them may fail to load while delivery remains partially suspended. Outside specialists are conducting a forensic investigation, and Helpfeel is taking questions through Gyazo’s support form.
