Gyazo image upload server vuln exposes 23.6M records and 490M metadata entries

The attacker obtained names, email addresses, password hashes, device IDs, X tokens, usage stats, billing details, and a list of private images. Roughly 23.62 million user records and 490 million image metadata records were accessed; the latter enable reconstruction of upload URLs. No payment card data was taken, yet anonymous accounts without emails still appear in the exposed set.

Helpfeel has not disclosed the specific vulnerability class, patch timeline, or whether the upload endpoint was isolated from the main database. This matches a recurring pattern in screenshot and file-hosting services where upload handlers run with excessive database privileges and minimal logging. Similar exposures occurred in prior Pastebin and Imgur-adjacent incidents where metadata alone permitted bulk private content discovery.

Operational impact centers on credential stuffing risk from unsalted or weakly hashed passwords and token replay via compromised X integrations. The private-image list creates targeted follow-on attack surface even if raw files remain unaccessed. Expect Helpfeel to face regulatory scrutiny in Japan and EU over delayed detection and incomplete user notification.

Next steps include mandatory password resets, token revocation for X-linked accounts, and forensic publication of the exploited CVE-equivalent. Independent researchers should monitor for Gyazo URL enumeration campaigns within 60 days.