Flaw in screenshot-sharing service Gyazo's upload server exploited, exposing about 23.62 million account records and 490 million image metadata records

Japan's Helpfeel said on September 16 that a third party exploited a vulnerability in the image upload server of its screenshot-sharing service Gyazo on September 11 to run arbitrary commands, then accessed the database and exfiltrated user data and image metadata ^[1]. About 23.62 million user records leaked, including names, emails, password hashes, login session IDs and X integration tokens, along with about 490 million image metadata records, and October 21 findings added that some images of 133 users were viewed and taken; the company says payment data was not leaked ^[1][2]. Gyazo users should change their password and any identical or similar passwords used elsewhere, and beware of suspicious related emails and messages ^[1].

Industries mainly affected: Technology

1. Change your Gyazo password and any identical or similar passwords used on other services ^[1].
2. Beware of suspicious emails and messages related to the incident .