On October 21, Helpfeel published the external investigation’s findings on the September intrusion at Gyazo, its image-sharing service. The report confirms that an attacker exploited a flaw in the server that converts uploaded content, then read large volumes of database data and sent data to an external server.
The findings clarify what data was affected and what remains uncertain. They do not describe a mass download of all images: investigators identified 432 files belonging to 133 users as viewed or obtained. Other headline figures concern accounts and metadata, not downloaded photos or screenshots.
What the investigation established
The intrusion began on September 11, 2026. Values supplied while Gyazo processed videos and other content were not properly handled and could be interpreted as server commands. The attacker then accessed the database and transferred data outside the service.
Available logs did not record the contents of outbound communications, so investigators could not determine exactly which fields or how many records left the systems. Given the large database reads and outbound data volume at the same time, the external specialists considered exfiltration reasonably likely.
Accounts and metadata affected
Helpfeel lists about 23.62 million affected accounts: 18.01 million without a registered email address and 5.62 million with one. These figures count accounts, not unique people. The data may include account identifiers, profile information and authentication-related data; payment card details were not involved.
The report also lists about 490 million metadata records, primarily associated with images uploaded before January 2019, plus metadata linked to deleted images. Metadata may include the upload IP address, text recognized in an image, EXIF location data or an identifier used to construct an image URL. These are metadata records, not 490 million image files.
What is known about the images
The investigation found no evidence of large-scale image-file acquisition or recovery of files corresponding to deleted images. Helpfeel did identify 432 files belonging to 133 users that were viewed or obtained, and says it notified those users individually.
The company cannot rule out that some images were viewed through URLs contained in the disclosed metadata. Older images remain visible only to their owners until those users review the content and choose to resume delivery. Reviewing old screenshots is useful, especially if they contained personal data, customer information or internal material.
Should you change your password?
Helpfeel clarified that the password-related information consisted of one-way hashes, not plaintext passwords. Certain authentication and integration details were invalidated. As of October 20, the company had not confirmed secondary misuse or identified the information on illicit marketplaces it was monitoring.
If you have not changed your Gyazo password since the incident, do so. Replace any identical or similar passwords used elsewhere: reusing a secret exposes multiple accounts through a single breach. Be alert to phishing messages about the incident; Helpfeel says it will not ask for a password or credit card number.
How this relates to Soclyde
A service breach can show why password reuse matters without meaning that every account has been compromised. A different password for each service limits how far an incident can spread. Soclyde helps organize business credentials in an encrypted vault on authorized devices; it does not protect Gyazo or reverse exposure of image metadata or files.
Key takeaway
The final report distinguishes account data, metadata and files that were actually viewed. Change an old Gyazo password, replace reused secrets, and inspect older images before resuming their sharing. To organize your team's access, read our guide to sharing passwords securely.
