Gyazo, the image-sharing service run by Helpfeel, has disclosed a breach that exposed roughly 23.6 million user records and about 490 million image metadata entries. An attacker exploited a flaw in Gyazo’s image upload server on September 11 to run commands against the backend, and stayed in until the company shut the access route down early the next morning.
What was actually taken
The exposed user data includes names, email addresses, password hashes, device IDs, X integration tokens, profile details, usage statistics, and billing information. Gyazo says payment card numbers were not stored on the affected system. The image metadata haul is the part worth pausing on: 490 million records that can be used to reconstruct the URLs of images users uploaded, which is a privacy problem even without a single password being cracked.
Gyazo detected suspicious activity the evening of September 11, blocked the access route and terminated the attacker’s session by the early hours of September 12, and notified Japan’s Personal Information Protection Commission on September 15. That is a reasonably fast internal response. It does not change the fact that an upload endpoint, a feature every user-facing web app has, was the door in.
What to do now
- If your product accepts file uploads of any kind, that code path deserves its own dedicated look. A web application penetration test is where upload handling, validation, and backend command execution paths actually get tested against real attacker techniques, not just a checklist.
- Get a secure code review of the upload server specifically. Command execution from an image upload path almost always traces back to unsafe handling of a filename, a metadata field, or a processing library invoked with attacker-controlled input.
- Rotate any long-lived tokens (API keys, third-party integration tokens) that could have been exposed alongside user records, and force a credential reset for affected accounts even though passwords were hashed.
- Review what metadata your own platform retains per uploaded asset. If you would not want 490 million rows of it in someone else’s hands, you probably should not be keeping it indefinitely.
The takeaway
Gyazo’s breach did not come from a phished admin or a stolen credential. It came from the exact feature the product exists to provide: uploading a file. Any service with the same core function should treat its upload path as a primary attack surface, not a solved problem.