From TechRadar · · 1m 20s
Gyazo breach exposes 23.62 million user records
Japanese image-sharing service Gyazo suffered a major cyberattack exposing millions of user records and hundreds of millions of image metadata files.
In brief
Japanese image-sharing service Gyazo suffered a major cyberattack exposing millions of user records and hundreds of millions of image metadata files. A vulnerability in Gyazo allowed attackers to access 23.62 million user records including passwords and session tokens, plus 490 million image metadata records that may…
Gyazo hit by major cyberattack
Japanese company Helpfeel, which runs image-sharing service Gyazo, suffered a breach on September 11 when attackers exploited a vulnerability to upload malware and run commands on its servers.
23.62 million user records stolen
The breach compromised 23.62 million records containing names, emails, password hashes, session IDs, Google SSO tokens, and subscription details. The actual number of affected individuals is lower since multiple records belong to the same user.
Private image metadata exposed
Attackers also accessed 490 million image metadata records from before January 2019, including image IDs, upload IP addresses, EXIF location data, and OCR text extracted from images.
Private images may have been viewed
Since metadata is used to generate image URLs, Helpfeel cannot rule out that attackers viewed actual private images. The company has temporarily disabled viewing of some images pending investigation.
“We have temporarily disabled viewing of some images to prevent further harm.”
Payment information remains secure
Helpfeel confirmed that no credit card numbers or payment information were exposed in the breach, limiting financial damage to affected users.
“We have confirmed that no payment information, including credit card numbers, was disclosed without authorization.”
The one thing
A vulnerability in Gyazo allowed attackers to access 23.62 million user records including passwords and session tokens, plus 490 million image metadata records that may have exposed private photos.
