Overview
The November 5 correction says roughly 23.62 million user entries are accounts, not people. Approximately 490 million, 2.4 million selectively queried, and 174 million deleted-image metadata entries are separate reported categories, not a calculated total. Deleted metadata links to about 1.12 million accounts, including about 57,000 closed accounts. Fields vary and include identity/email, password hashes, authentication data, image URLs, IP and OCR metadata. Mass image-file acquisition was not established; payment information and Helpfeel/Cosense systems were unaffected.
Timeline
- Occurred
- Discovered
- Disclosed
Intrusion blocked and vulnerability patched.
Database-information exfiltration confirmed.
First public report.
Service resumed with restrictions.
Final investigation results published.
Added target periods and corrected accounts associated with deleted metadata.
Organization response
Helpfeel patched the vulnerability on September 12, invalidated authentication information, suspended delivery/service and resumed with restrictions on September 27. It published forensic findings and notices.
What you can do
Change unchanged Gyazo passwords and review reuse elsewhere. Review owned images and beware of impersonation messages.
Sources
- Gyazo情報漏えい調査結果（第三報、11月5日訂正・追記）株式会社Helpfeel · 2026-11-09
- Gyazoへの不正アクセスによる情報漏えいに関するお知らせ（第一報）株式会社Helpfeel · 2026-11-09