Notice Regarding Unauthorized Access to Gyazo: Investigation Results (Update 3)
Thank you for using the services provided by Helpfeel Inc.
Helpfeel Inc. (Head Office: Kyoto, Japan; Representative Director and CEO: Isshu Rakusai; hereinafter “Helpfeel”) previously announced unauthorized access by a third party to Gyazo, our image-sharing service, and the resulting data breach in our notices dated September 16, 2026 (First Notice) and September 25, 2026 (Second Notice).
We have now received the final report from the forensic investigation conducted by external security specialists. Based on the findings of that investigation and our own investigation, this notice provides our final investigation results regarding the cause of the incident, the scope of the affected data, the measures taken to date, and our efforts to prevent recurrence.
In this notice, “images” refers to content captured or stored via Gyazo, including screenshots, GIFs, and videos. The types of information included in “metadata” are as described in the First Notice.
This notice reflects information confirmed as of October 20, 2026. If additional material facts requiring disclosure are identified, we will provide a further update. Unless otherwise stated, all dates and times are in Japan Standard Time (JST).
1. Incident Overview
On September 11, 2026, a third party exploited a vulnerability in Gyazo’s image upload server to gain unauthorized access to our systems and execute arbitrary commands. Between September 11 and the early hours of September 12, the third party accessed Gyazo’s database and transmitted user information and image-related metadata to an external server.
We detected suspicious activity on the evening of September 11. By the early hours of September 12, we had blocked the identified intrusion route, and terminated the unauthorized connections. Later that day, we completed remediation of the vulnerability.
We subsequently took additional measures to mitigate the risk of further harm, including suspending image delivery, temporarily taking the service offline, and invalidating compromised authentication-related information. Gyazo services resumed on September 27.
To date, we have not identified any confirmed cases of misuse of personal information, impersonation, financial loss, or other harm attributable to this incident (see Section 5, “Status of Secondary Harm”).
2. Timeline and Response
Date | Incident and Response |
|---|---|
September 11 | Unauthorized access to Gyazo occurred. We detected suspicious activity that evening and began investigating and responding to the incident. |
September 12 | By the early hours of September 12, we had blocked the unauthorized access routes and terminated unauthorized connections. We also completed remediation of the vulnerability that was exploited. |
September 14 | We confirmed that information from Gyazo's database had been disclosed without authorization. We suspended delivery of all images to prevent further harm. |
September 15 | We implemented additional measures, including invalidating compromised authentication-related information, and submitted a preliminary report to Japan's Personal Information Protection Commission (PIPC). |
September 16 | We published the First Notice and began reporting the incident to Japan's Ministry of Internal Affairs and Communications (MIC). |
September 17 | We began reporting the incident to overseas data protection authorities. |
September 18 | We temporarily suspended Gyazo services to prevent further harm and commissioned a forensic investigation by external security specialists. We also published a notice regarding the impact on Helpfeel and Cosense. |
September 24 | We submitted follow-up reports to the PIPC and MIC. |
September 25 | We published the Second Notice. The forensic investigation by external specialists began. |
September 27 | Following a security review and the implementation of countermeasures across Gyazo, we resumed the service. Images uploaded before the unauthorized access were made viewable only by their owners. |
October 15 | We received the final report from the external security specialists. |
October 19 | We received an explanation of the final report from the external security specialists. |
October 21 | We published the investigation results in this notice. |
3. Results of the Investigation by External Specialists
(3-1) Overview of the Investigation
On September 18, 2026, we commissioned external security specialists to conduct a forensic investigation, which was carried out from September 25 through October 15.
The investigation involved examining and comparing various logs recorded in Gyazo's server environment and cloud infrastructure to assess how the unauthorized access occurred, the scope of the third party's activities, and the extent of the potential data breach.
We received the final investigation report on October 15.
(3-2) Cause and Method of Unauthorized Access
The investigation confirmed that the incident was caused by a vulnerability in part of the processing used to convert uploaded videos and other content on Gyazo's image upload server. Specifically, externally supplied input values were not properly processed and could be interpreted as commands on the server.
The third party exploited this vulnerability to execute arbitrary commands on the server responsible for content conversion. The investigation determined that the third party then connected to a database accessible from that server, read large volumes of data, and transmitted the data to an external server.
This incident was not caused by external software components or a third-party service provider (a so-called supply chain attack). Rather, it resulted from a vulnerability in a system developed and operated by Helpfeel.
We completed remediation of the vulnerability on September 12. We also reviewed the entire Gyazo source code for similar issues and completed remediation of identified high-severity issues.
(3-3) Scope of the Third Party's Activities
Unauthorized activity was confirmed between the afternoon of September 11 and the early hours of September 12, 2026.
During this period, the third party executed unauthorized processes on the content conversion server, explored the internal environment, read large volumes of data from the database, and transmitted data to an external server.
Since we blocked the unauthorized access routes in the early hours of September 12, we have not confirmed any further unauthorized access through the same routes.
Within the scope of the investigation, no records were found indicating that the third party had extended the intrusion to other systems or left behind malicious programs intended to enable further unauthorized access.
(3-4) Assessment of the Scope of the Data Breach
The investigation conducted by the external security specialists confirmed from system logs that processes executed by the third party resulted in large-scale reads from the database. The logs also showed that, during the same period, a large volume of data was transmitted from the same server to a specific external server.
However, because no logs were available that recorded the actual contents of the transmitted communications, it was not possible to directly determine the specific data fields or number of records transmitted outside our systems. Based on the available evidence, the external security specialists assessed that there was a reasonably high likelihood that data had been exfiltrated.
(3-5) Investigation Findings Regarding Access to Image Files
Regarding the image files themselves, no records were found indicating that the third party had obtained a large volume of image files. No records were found indicating that image files corresponding to deleted images had been obtained.
However, following an additional investigation conducted by Helpfeel based on the findings of the external forensic investigation, we confirmed that the third party had viewed or obtained certain images stored by 133 Gyazo users.
We have already individually notified the affected users, specifying the images involved, and provided guidance on the necessary actions. We have also confirmed that the affected images belonging to these 133 users did not contain information belonging to Helpfeel or Cosense customers.
As previously announced, we cannot completely rule out the possibility that some images were viewed using image URLs contained in the disclosed metadata.
For this reason, we will continue to require users to review the content of images uploaded before the unauthorized access occurred and choose whether to resume image delivery (see Section 7, “Response to Gyazo Users”).
(3-6) Impact on Helpfeel and Cosense
Helpfeel and Cosense, which are also provided by Helpfeel Inc., operate on system architectures that differ from Gyazo's and are not connected to the access routes exploited in this incident.
Our security review found no evidence of unauthorized disclosure of information from the Helpfeel or Cosense systems, nor any evidence of unauthorized access to either service.
Our assessment remains unchanged from the Second Notice.
4. Scope of the Data Breach
Based on the investigation conducted by the external specialists and our own investigation, the scope of the data breach is as follows.
Affected Data | Record Count | Scope | Notes |
|---|---|---|---|
User information | Approx. 23.62 million records | Anonymous users with no registered email address: approx. 18.01 million (approx. 76%). Users with a registered email address: approx. 5.62 million (approx. 24%). | These figures represent the number of accounts, not the number of individuals. The types of information involved remain as described in the First Notice and vary by user. No payment information, including credit card numbers, was included. |
Image metadata | Approx. 490 million records | Associated primarily with images uploaded in or before January 2019 (approx. 14.4% of all images). | These figures refer to metadata records, not the number of image files themselves disclosed. The types of metadata involved remain as described in the First Notice. |
Image metadata retrieved using specific filtering criteria | Approx. 2.4 million records | Approx. 0.07% of all images. | Same as above. |
Metadata for deleted images | Approx. 174 million records | Associated primarily with images deleted in or before February 2023 and images owned by users whose accounts were deleted in or before February 2023 (approx. 5.1% of all images). | Same as above. |
Image files belonging to specific users | 432 files | Certain images belonging to 133 identified users. | We have already sent notifications to the registered email addresses of the affected users. |
Due to rounding, the sum of the breakdowns may not perfectly match the totals.
We have not confirmed unauthorized disclosure of any images or image metadata beyond those listed above.
Information Confirmed Not to Have Been Disclosed
- Payment information, including credit card numbers (as stated in the First and Second Notices).
- Image files themselves (no records indicating large-scale acquisition were found; see Section 3-5 regarding the possibility that some images were viewed).
- Image files corresponding to deleted images.
- Information stored in the Helpfeel and Cosense systems.
We would also like to clarify that the password-related information reported as disclosed in the First Notice consisted of password hashes generated through a one-way transformation process, not actual passwords. The passwords themselves were not disclosed.
In addition, we have already invalidated certain authentication-related information and information associated with integrations with external services.
Accordingly, we believe that the compromised authentication-related information alone can no longer be used to gain unauthorized access, and that no secondary harm will arise from its use.
5. Status of Secondary Harm
To date, we have not confirmed any misuse of personal information, impersonation, or other secondary harm resulting from this incident.
Since late September 2026, we have been continuously monitoring whether the disclosed information has been published or offered for sale on illicit online marketplaces, including the so-called dark web, using external monitoring services and other means.
As of October 20, 2026, we have not identified any such information.
We will continue this monitoring for at least one year. If we identify any new facts that should be shared, we will promptly notify the affected users and other relevant parties.
6. Handling of Metadata for Deleted Images and Future Policy
Under Gyazo's previous practices, when a user deleted an image, the image file itself was deleted after a certain period. However, metadata associated with deleted images was retained for purposes including investigating misuse of the service and responding to inquiries from public authorities.
In light of the impact of this data breach, we will implement the following measures as part of our efforts to prevent a recurrence, including changes to the handling of metadata for deleted images and information associated with deleted accounts.
- We will establish and implement a deletion policy under which metadata associated with deleted images will be automatically deleted 60 days after the images are deleted.
- We will progressively delete metadata associated with previously deleted images, including metadata affected by this incident, to the extent that doing so does not interfere with reporting to relevant authorities or preservation required by applicable laws and regulations.
- We will also establish retention periods and delete operational records and other information associated with deleted user accounts.
- We will establish policies regarding data retention periods and disclose them in our Privacy Policy and other relevant documents.
7. Response to Gyazo Users
(7-1) Notifications Provided to Date
Since September 20, 2026, we have been sending notifications on a rolling basis to the registered email addresses of Gyazo users who may have been affected by this incident.
We have also posted notices regarding the incident within the Gyazo service interface.
(7-2) Notification to Users Affected by the Disclosure of Metadata for Deleted Images
Regarding the metadata for deleted images reported in the Second Notice, we have identified approximately 57,000 accounts, including deleted and canceled accounts, that may have been affected by the data breach and for which contact email addresses are available.
Following publication of this notice, we will begin notifying the relevant users by email on a rolling basis.
Please note that notification emails sent by Helpfeel regarding this incident will not ask recipients to access any URLs or take any action on linked websites.
We ask all users to remain vigilant for suspicious emails, phishing attempts, or communications impersonating Helpfeel.
(7-3) Response to Corporate Customers
We are providing necessary information to our corporate customers through their Helpfeel representatives in accordance with their contractual arrangements.
We have also reviewed the use of Gyazo in our internal business operations and are notifying customers who need to be informed.
(7-4) Current Image Viewing Status and Resumption of Image Delivery
Images uploaded before the unauthorized access occurred remain accessible only to their owners, and users must review the content of their images before choosing to resume image delivery. Images in Gyazo Teams may also be viewed by other members of the same team.
For instructions on resuming image delivery, please refer to our “Notice Regarding the Resumption of Gyazo Services” (September 27, 2026).
We will maintain this approach permanently and will not resume delivery of all users' images at once based solely on Helpfeel's decision.
(7-5) Actions We Ask Users to Take to Prevent Further Harm
If you have not changed your Gyazo password since this incident occurred, we ask that you do so.
If you use the same or a similar password for Gyazo and any other services, we also ask that you change your passwords for those services.
Please remain vigilant for suspicious emails, messages, or other communications related to this incident, including those impersonating Helpfeel.
Helpfeel will not ask you to provide your password or credit card number in connection with this incident.
8. Reporting to Regulatory Authorities and Consultation with Law Enforcement
- Personal Information Protection Commission (PIPC): We submitted a preliminary report on September 15, 2026, in accordance with Japan's Act on the Protection of Personal Information, followed by an additional report on September 24. We continue to coordinate with the PIPC and will submit a final report reflecting the investigation findings within the period required by law.
- Ministry of Internal Affairs and Communications (MIC): We began reporting the incident to the MIC on September 16 and submitted reports on September 17 and September 24. We are continuing preparations for the submission of a final report. We also plan to provide information on indicators of compromise (IOCs).
- Overseas Data Protection Authorities: In accordance with applicable laws and regulations in each country and region, including the GDPR, we have reported the incident to supervisory authorities in approximately 30 countries and regions and are responding to their inquiries.
- Police: We have consulted with the Kyoto Prefectural Police. We will cooperate with investigations and efforts to prevent similar attacks, including by providing information on indicators of compromise (IOCs).
9. Security Measures and Prevention of Recurrence
Based on the cause of the incident and the findings of the investigation, we are implementing the following measures.
(9-1) Completed Measures
- Remediation of the vulnerability that caused the incident and blocking of the unauthorized access routes exploited by the third party (September 12, 2026).
- Invalidation of certain authentication-related information and information associated with integrations with external services that may have been compromised.
- Security review of the entire Gyazo source code and remediation of identified high-severity issues (completed before service resumption).
- Strengthening of access controls between internal systems and encryption of internal communications.
- Implementation of image viewing restrictions to prevent further harm and provision of a mechanism allowing users to resume image delivery after reviewing the content themselves.
- Emergency security reviews across all Helpfeel services, including Helpfeel and Cosense.
(9-2) Ongoing Measures
- Introduction and continuous use of AI-assisted static source code analysis across all our services, and establishment of a process for continuously detecting vulnerabilities specific to individual systems, including vulnerabilities similar to the one exploited in this incident.
- Vulnerability assessments of all Helpfeel services conducted by external specialists.
- Review of system design to minimize potential damage in the event of an intrusion.
- Extension of log retention periods and enhancement of monitoring and anomaly detection for external data transmissions and database access.
- Establishment and implementation of policies regarding data retention periods and deletion (see Section 6).
- Continued monitoring of disclosed information, including on the dark web, for at least one year.
(9-3) Strengthening Our Security Organization and Practices
- Establishment of a Security Operations Center (SOC) dedicated to security monitoring and incident response, along with stronger monitoring and audit processes.
- Enhancement of security training for all developers and improvement of secure design, development, and review practices.
- Review of internal information management policies, including the use of image-sharing tools for business purposes, and implementation of employee training.
10. Status of This Report and Next Steps
This notice constitutes our final report on the incident based on the findings of the investigation conducted by external specialists.
However, we will continue reporting to relevant authorities, notifying affected users and other parties, monitoring the disclosed information, and implementing measures to prevent a recurrence. If we identify any additional facts that should be shared or make progress that warrants further reporting, we will promptly publish an update.
We take this incident extremely seriously and are committed, as an entire organization, to fulfilling our responsibility to protect the information entrusted to us, preventing a recurrence, and restoring trust.
We deeply regret the concern and inconvenience this incident has caused to Gyazo users and other affected parties.
For inquiries regarding Gyazo:
・Japanese: https://help-ja.gyazo.com/contact-us
・English: https://help.gyazo.com/contact-us
For media inquiries: Helpfeel Public Relations (pr@helpfeel.com)
