Japanese software company Helpfeel is notifying users of its image-sharing service Gyazo that their information has been accessed by hackers.
Gyazo is a widely used cross-platform tool that allows users to capture screenshots, GIFs, or short screen recordings and instantly generate shareable links.
Helpfeel announced this week that it had recently detected unauthorized access to Gyazo servers. On September 11, a hacker exploited a vulnerability in its image upload server to execute malicious commands.
The attacker was kicked out the next day, but not before accessing a database that stored around 23.6 million user records.
Compromised Gyazo user information includes names, email addresses, password hashes, user and device IDs, X integration tokens, profile information, usage statistics, and billing information.
According to the provider, the payment card information was not compromised.
“The approximately 23.62 million records affected include records from anonymous accounts without registered email addresses or similar information. We are continuing to determine the actual number of individuals whose personal information was shared without authorization.” Helpfeel said.
In addition to user records, the attacker accessed approximately 490 million image metadata records. This metadata includes information that could allow threat actors to reconstruct and access URLs associated with images uploaded by users.
A list of private images was also compromised, but the company did not provide any information about the extent.
Related: Brevo supply chain attack injects malware into 100,000 websites
Related: Revolut data breach: 5 months, 680 high-profile accounts, $3 million ransom
Related: 280,000 affected by Premier Medical Group data breach
