Summary
- Environment: Image-upload server and account/image databases
- Operational impact: Account metadata exposed; specific image access confirmed
- Financial impact: No incident cost publicly quantified
- Record status: Developing record. Reviewed November 5, 2026; updated as evidence emerges.
What happened
Impact
The report identifies about 23.62 million account records, not people; about 490 million image-metadata records; 2.4 million filtered metadata records; and 174 million deleted-image metadata records. [1]
Helpfeel confirmed 432 image files belonging to 133 users were viewed or obtained. It found no evidence of bulk image-file acquisition. [1]
Timeline
Intrusion detected
Intrusion detected, as described in the incident notice.
[1]Access blocked and flaw fixed
Access blocked and flaw fixed, as described in the incident notice.
[1]Gyazo service resumed
Gyazo service resumed, as described in the incident notice.
[1]Account-scope correction published
Account-scope correction published, as described in the incident notice.
[1]Briefing updated
This briefing was last reviewed and updated on November 5, 2026.
Threat Group & Attack Vector
The flaw was in Helpfeel’s own content-conversion code, rather than an external software supplier. [1]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- T1190 — Exploit Public-Facing Application. [1]
Response
The November 5 correction associates deleted-image metadata with about 1.12 million accounts, including about 57,000 closed or canceled accounts. It also dates the filtered metadata mainly to two-day periods starting January 1, 2016 and January 1, 2020 UTC. [1]
Helpfeel blocked the access route and fixed the flaw September 12; Gyazo resumed September 27 after additional safeguards. Individual notices and data-retention changes followed. [1]