--- title: "Gyazo account and image-metadata incident" description: "Helpfeel reported that a Gyazo upload-server vulnerability enabled arbitrary commands and database access on September 11–12, 2026." incident_type: "Cybersecurity incident" status: "active" last_modified: "2026-11-05" canonical_url: "https://www.ally.security/incidents/gyazo-account-and-image-metadata-incident-2026" markdown_url: "https://www.ally.security/incidents/gyazo-account-and-image-metadata-incident-2026.md" stix_url: "https://www.ally.security/incidents/gyazo-account-and-image-metadata-incident-2026/stix.json" --- # Gyazo account and image-metadata incident Helpfeel reported that a Gyazo upload-server vulnerability enabled arbitrary commands and database access on September 11–12, 2026. Last modified Nov 5, 2026 · 1 source ## Summary - **Environment:** Image-upload server and account/image databases - **Operational impact:** Account metadata exposed; specific image access confirmed - **Financial impact:** No incident cost publicly quantified ## What happened [Helpfeel](https://corp.helpfeel.com/) reported that a [Gyazo](https://gyazo.com/) upload-server vulnerability enabled arbitrary commands and database access on September 11–12, 2026. [1](#source-1) ## Impact The report identifies about 23.62 million account records, not people; about 490 million image-metadata records; 2.4 million filtered metadata records; and 174 million deleted-image metadata records. [1](#source-1) Helpfeel confirmed 432 image files belonging to 133 users were viewed or obtained. It found no evidence of bulk image-file acquisition. [1](#source-1) ## Timeline ### September 11, 2026 — Intrusion detected Intrusion detected, as described in the [incident notice](https://corp.helpfeel.com/en/news/news-20261021-2). [1](#source-1) ### September 12, 2026 — Access blocked and flaw fixed Access blocked and flaw fixed, as described in the [incident notice](https://corp.helpfeel.com/en/news/news-20261021-2). [1](#source-1) ### September 27, 2026 — Gyazo service resumed Gyazo service resumed, as described in the [incident notice](https://corp.helpfeel.com/en/news/news-20261021-2). [1](#source-1) ### November 5, 2026 — Account-scope correction published Account-scope correction published, as described in the [incident notice](https://corp.helpfeel.com/en/news/news-20261021-2). [1](#source-1) ### November 5, 2026 — Briefing updated This briefing was last reviewed and updated on November 5, 2026. ## Threat Group & Attack Vector The flaw was in Helpfeel’s own content-conversion code, rather than an external software supplier. [1](#source-1) ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - T1190 — [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190/). [1](#source-1) ## Response The November 5 correction associates deleted-image metadata with about 1.12 million accounts, including about 57,000 closed or canceled accounts. It also dates the filtered metadata mainly to two-day periods starting January 1, 2016 and January 1, 2020 UTC. [1](#source-1) Helpfeel blocked the access route and fixed the flaw September 12; Gyazo resumed September 27 after additional safeguards. Individual notices and data-retention changes followed. [1](#source-1) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### Notice Regarding Unauthorized Access to Gyazo: Investigation Results (Update 3) official · Helpfeel · Oct 21, 2026
Evidence ledger Review the supporting structured claims. 1. **Resulted In · 100% confidence · current** Gyazo account and image-metadata breach: The report identifies about 23.62 million account records, not people; about 490 million image-metadata records; 2.4 million filtered metadata records; and 174 million deleted-image metadata records. 2. **Resulted In · 100% confidence · current** Gyazo account and image-metadata breach: Account-scope correction published 3. **Resulted In · 100% confidence · current** Gyazo account and image-metadata breach: Access blocked and flaw fixed 4. **Resulted In · 100% confidence · current** Gyazo account and image-metadata breach: The November 5 correction associates deleted-image metadata with about 1.12 million accounts, including about 57,000 closed or canceled accounts. It also dates the filtered metadata mainly to two-day periods starting January 1, 2016 and January 1, 2020 UTC. 5. **Occurred At · 100% confidence · current** Gyazo service resumed: 2026-09-27 6. **Occurred At · 100% confidence · current** Access blocked and flaw fixed: 2026-09-12 7. **Resulted In · 100% confidence · current** Gyazo account and image-metadata breach: The flaw was in Helpfeel’s own content-conversion code, rather than an external software supplier. 8. **Used Attack Technique · 100% confidence · current** Gyazo account and image-metadata breach: https://attack.mitre.org/techniques/T1190/ 9. **Resulted In · 100% confidence · current** Gyazo account and image-metadata breach: Helpfeel reported that a Gyazo upload-server vulnerability enabled arbitrary commands and database access on September 11–12, 2026. 10. **Resulted In · 100% confidence · current** Gyazo account and image-metadata breach: Gyazo service resumed 11. **Discovered At · 100% confidence · current** Gyazo account and image-metadata breach: 2026-09-11 12. **Resulted In · 100% confidence · current** Gyazo account and image-metadata breach: Intrusion detected 13. **Resulted In · 100% confidence · current** Gyazo account and image-metadata breach: Helpfeel confirmed 432 image files belonging to 133 users were viewed or obtained. It found no evidence of bulk image-file acquisition. 14. **Disclosed At · 100% confidence · current** Gyazo account and image-metadata breach: 2026-09-16 15. **Affected Organization · 100% confidence · current** Gyazo account and image-metadata breach: Helpfeel 16. **Resulted In · 100% confidence · current** Gyazo account and image-metadata breach: Helpfeel blocked the access route and fixed the flaw September 12; Gyazo resumed September 27 after additional safeguards. Individual notices and data-retention changes followed. 17. **Occurred At · 100% confidence · current** Account-scope correction published: 2026-11-05 18. **Occurred At · 100% confidence · current** Intrusion detected: 2026-09-11