KYOTO, September 25 — Helpfeel Inc., the Japanese software company behind the Gyazo screenshot-sharing service, has disclosed a data breach affecting approximately 23.62 million user records, according to a notice issued by the company. The company said it discovered unauthorised access to its Gyazo servers after a threat actor exploited a vulnerability in the service’s image upload server on September 11 and was able to run malicious commands.
The attacker was locked out the following day, September 12, but by then had already reached a database holding roughly 23.6 million user records. “We have confirmed that approximately 23.62 million records containing data related to Gyazo users were disclosed without authorization,” Helpfeel stated in its notice.
What was taken
The exposed records include names or nicknames, email addresses, password hashes, user IDs, device IDs, login session IDs, X integration tokens, Google SSO email addresses, profile information, language preferences, registration and last login dates and times, subscription plans, billing status, and usage statistics. Anonymous accounts without registered email addresses are among the affected records. Helpfeel said no payment information, including credit card numbers, was exposed.
Separately, about 490 million image metadata records were exposed, mainly linked to images uploaded in or before January 2019. Metadata from another 2.4 million images was also accessed through specific searches.
That metadata may include image IDs, upload IP addresses, User-Agent data, EXIF location information, OCR text, image titles, source URLs, other metadata and hashed passphrases for private images. Some of that information could potentially be used to reconstruct Gyazo image URLs and access images without authorisation. Helpfeel temporarily disabled access to some images and confirmed that a list of private images was obtained.
It has not confirmed that image files themselves were stolen, but cannot rule out that some private images were viewed. No unauthorised disclosure has been confirmed in Helpfeel or Cosense systems.
The company’s response
Helpfeel, headquartered in Kyoto and led by Representative Director and CEO Isshu Rakusai, said it has closed off the access routes used in the incident and completed remediation of the exploited vulnerability. “We have blocked all access routes used in the incident and have completed remediation of the vulnerability that was exploited,” the company said. “We continue to prioritize measures to prevent further harm while investigating the scope and impact of the incident.” Notifications will go to the registered email addresses of affected Gyazo users.
“We plan to send notifications regarding this incident to the registered email addresses of Gyazo users who may have been affected,” Helpfeel said. “We are currently working to identify users whose information was disclosed without authorization and will determine which users to notify based on the progress of our investigation.” For users who cannot be reached by email, such as those with anonymous accounts, notices will appear through the Gyazo web interface.
The investigation is ongoing, and Helpfeel said it will publish updates if further information emerges. The company is asking all Gyazo users to change their passwords, particularly where the same or a similar password is used on other services, and to stay alert for suspicious emails, messages or other communications that may attempt to exploit the breach.
What to watch next: whether Helpfeel’s user notifications reach the anonymous accounts that make up part of the affected records, and whether the company’s ongoing investigation turns up evidence that private image files, rather than metadata alone, were taken.
