Gyazo Security Breach Exposes 23.62 Million User Records
A security breach at Gyazo, the image-sharing service operated by Helpfeel, has led to the exposure of about 23.62 million user records, which include email addresses and password hashes. The Kyoto-based company disclosed this information in a notice published on Wednesday. In addition to user records, the breach has also compromised approximately 490 million image metadata records, primarily related to images uploaded in January 2019 or earlier. These records include the IDs that form the links to Gyazo images.
Helpfeel has indicated that these IDs could potentially allow unauthorized access to view images, prompting the company to temporarily disable access to some of these images. Users have been urged to change their passwords, especially if they use the same or similar passwords across different services. They are also advised to remain vigilant for any suspicious emails or messages that may arise as a result of the breach.
The breach occurred due to a vulnerability in Gyazo's image upload server, which allowed the attacker to execute arbitrary commands on Helpfeel's systems and gain access to Gyazo's database. The specific nature of the vulnerability has not been disclosed by the company. Fortunately, Helpfeel has confirmed that no payment information, including credit card details, was compromised during this incident.
The reported figure of 23.62 million user records includes accounts that are anonymous and do not have registered email addresses. Helpfeel is currently assessing how many users had their personal information exposed. The company has stated that it has taken necessary measures regarding the exposed authentication data, although it has not specified which items were invalidated.
Gyazo typically sends a verification code when a login is attempted from a new IP address, but it remains unclear whether the exposed session IDs are still valid. Each Gyazo capture generates a link composed of a 32-character image ID, which is designed to be unguessable. However, the leaked image IDs could compromise the privacy of these captures, as the only protection for a default setting capture is the link itself.
Impact of Metadata Exposure on User Privacy
Helpfeel has noted that the affected metadata records represent about 14.4% of its image-related data. Additionally, metadata for another 2.4 million images was retrieved using unspecified filtering criteria. The company has not clarified whether these two sets of data overlap or if the second set includes newer images.
To mitigate further risks, Helpfeel has temporarily disabled the viewing of certain images and has not reported any loss of image data. However, it has not specified which images are affected or how users can determine if their captures are included in the compromised sets. The attacker also accessed a list of private images, raising concerns that some private images may have been viewed.
Cleared to File
Helpfeel detected suspicious activity on the evening of September 11, Japan time, and by the early hours of September 12, it had blocked the identified access routes and fixed the vulnerability. Despite the ongoing issues with image loading, Gyazo's public communications initially described the situation as maintenance without mentioning the breach. On September 14, the company suspended image delivery, citing emergency maintenance, and resumed service on September 15, although some images remained unavailable.
Helpfeel confirmed the data exposure on September 14 and reported the incident to Japan's Personal Information Protection Commission the following day. The company is currently conducting a forensic investigation with the assistance of external specialists and plans to notify affected users directly, while also providing information on Gyazo's website for anonymous accounts. Helpfeel has assured that its other products, Helpfeel and Cosense, operate on separate systems and have not experienced any data exposure, although Gyazo images displayed within those products may not load during the ongoing image delivery suspension.
