Helpfeel, a Kyoto-based company that operates the image-sharing platform Gyazo, disclosed a data breach affecting 23.62 million user records on Wednesday. The exposed data includes email addresses and password hashes for affected users.
The breach scope extends far beyond user credentials. Attackers also obtained approximately 490 million image metadata records, primarily consisting of images uploaded to Gyazo on or before January 2019. This metadata includes the unique identifiers that compose Gyazo image URLs, potentially allowing adversaries to enumerate and access historical image links.
Gyazo functions as a screenshot and image-sharing service used by developers, designers, and content creators worldwide. Users rely on the platform to quickly capture, store, and share visual content. The service generates shareable links for each uploaded image, making the exposure of these identifiers particularly problematic. An attacker with access to image IDs could potentially reconstruct links and retrieve images users believed were private or forgotten.
The password hashes present a secondary risk. While hashing obscures plaintext passwords, the viability of this protection depends entirely on the hashing algorithm employed. If Helpfeel used weak or outdated algorithms like MD5 or unsalted SHA-1, attackers could crack hashes using rainbow tables or brute-force techniques, compromising user accounts across other services where users reused passwords. Modern hashing standards like bcrypt, Argon2, or PBKDF2 with adequate salt and iteration counts provide stronger protection, but organizations rarely disclose hash specifications during breach notifications.
Email addresses carry standalone value for attackers. Confirmed valid email addresses from this breach feed into phishing campaigns, credential stuffing attacks, and targeted social engineering. Threat actors frequently combine breached emails with other datasets to build comprehensive targeting profiles.
The temporal aspect of the metadata exposure deserves attention. The majority of affected image records date from January 2019 or earlier. This suggests the breach may have occurred recently but exposed dormant data, or that attackers retained access to historical records for years without detection. Either scenario indicates insufficient access controls and monitoring at Helpfeel.
Organizations using Gyazo for internal communications, design workflows, or documentation should treat any images uploaded before January 2019 as potentially exposed. Screenshots containing sensitive information, internal network diagrams, API keys, or confidential communications shared via Gyazo during this window now exist outside the company's control.
Helpfeel has not specified when the breach occurred, how attackers gained access, or whether they obtained additional data beyond user records and image metadata. The company has not announced specific remediation timelines or compensation programs. Users should change their Gyazo passwords immediately and update passwords on any other accounts where they reused the same credentials. Organizations should review audit logs for Gyazo activity and assess whether any shared images contained sensitive information.
The breach underscores persistent gaps in how cloud-based service providers implement security monitoring and access controls. A dataset of 490 million records does not vanish unnoticed without substantial security blind spots.