Screenshot tool Gyazo (Helpfeel Inc.) is in the breach ticker after the company’s English notice and today’s SecurityWeek write-up.
On September 11, 2026 (JST), a third party exploited a vulnerability in Gyazo’s image upload server and ran arbitrary commands. Helpfeel says it detected the activity that evening and, by early September 12, blocked the identified routes and cut the unauthorized sessions. The vulnerability used in the intrusion was remediated the same day.
As of the September 16 notice, Helpfeel confirmed unauthorized disclosure of approximately 23.62 million user-related records. Fields can include name/nickname, email, password hash, user and device IDs, session IDs, X integration tokens (if connected), Google SSO email (if connected), profile and plan data, billing status (not card numbers), and usage stats. The 23.62M figure includes anonymous accounts without an email; Helpfeel says it is still determining how many distinct people were hit. It states no credit card numbers or other payment-method data were disclosed.
Separately, roughly 490 million image-metadata records — mostly for images registered on or before January 2019 (~14.4% of image-related data) — were disclosed, plus metadata for about 2.4 million images pulled with specific filters. Metadata includes image IDs used to build Gyazo URLs, upload IP, User-Agent, EXIF location when present, OCR text, titles, and hashed passphrases for private images. Helpfeel says URL-building fields could let a third party view matching images, temporarily disabled some viewing, and cannot rule out that some private images were viewed. It has not confirmed loss of image binary data. Helpfeel and Cosense systems are described as architecturally separate, with no confirmed disclosure from those products so far.
POV: a consumer screenshot SaaS with enterprise bleed (tokens, OCR on screenshots, reconstructable private URLs) is a credential-reset and token-revoke event, not just a “change password” banner. Underwrite Helpfeel’s Sep 16 counts; any higher “unique victim” tally remains Undisclosed until they print one.