Gyazo Breach Exposes 23.62 Million User Records and 490 Million Image Metadata Records

Helpfeel (Gyazo) disclosed a security breach after an attacker exploited a vulnerability in Gyazo's image upload server to execute arbitrary commands and access the database, exposing ~23.62 million user records (emails, password hashes, session/device IDs, SSO tokens, profile/billing metadata) and ~490 million image metadata records (image IDs, upload IPs, user-agents, EXIF location data, OCR text, hashed image passphrases). The company blocked the intrusion, patched the vulnerability, disabled viewing of some images, engaged an external forensics firm, reported to Japan's regulator, and is notifying affected users; recommended user actions include changing passwords, enabling MFA, and treating shared Gyazo links as potentially exposed.