Correction and update, October 28, 2026: The previous article blurred metadata exposure with confirmed access to image contents. We replaced generic news citations with Helpfeel’s notices and incorporated its October investigation results. The counts below describe different categories and should not be added together as a victim count.
Helpfeel’s October 21 update, reflecting information confirmed as of October 20, distinguishes a large database incident from the narrower set of image files it confirmed were viewed or obtained. These are the company’s published findings; this site has not independently examined the affected systems or the underlying forensic report.
The original disclosure concerned records
The September 16 notice said an attacker exploited an image-upload server vulnerability on September 11, accessed the database and exposed user information and image-related metadata. Listed categories included password hashes and session information, plus image IDs, upload IP addresses and EXIF location data where present.
The original notice reported approximately 23.62 million user records and 490 million image-metadata records. A metadata record can contain information about a file without being the file itself. EXIF location information also depends on whether that information existed in an image; the category does not establish that every screenshot contained a location.
Accounts are not unique people
The September 25 clarification explained that most affected account records belonged to anonymous accounts without registered email addresses. It also added approximately 174 million metadata records associated with deleted images.
That notice specifically distinguished metadata from image files and said the newly identified category did not include the deleted image files themselves. It also said affected OAuth authentication information had been invalidated and that the exposed X integration tokens alone could not operate an X account.
Those distinctions correct two misleading shortcuts: treating every account record as an identified person, and treating every metadata record as a confirmed stolen screenshot.
What October’s investigation confirmed
The October update says Helpfeel confirmed that 432 files belonging to 133 users were viewed or obtained. It found no records indicating large-scale acquisition of image files, while retaining a warning that other images might have been viewed through URLs in exposed metadata.
The same update describes a limit in the evidence: logs showed large database reads and outgoing data transfers, but did not record the transmitted contents. The external specialists therefore could not directly determine the specific fields or exact record count transmitted. The published scope figures should be read alongside that limitation.
What users can check
Helpfeel’s initial guidance asked users to change Gyazo passwords and any reused passwords on other services, and to watch for suspicious communications. Use the official service and notices to review the instructions applying to your account.
Keep account records, file metadata and file contents separate when assessing what a notification says. A broad exposure category does not establish the contents of a particular image; an absence of confirmed misuse does not establish that future harm is impossible. Preserve relevant notices and ask the provider for clarification about the specific information involved rather than inferring an individual result from the largest headline number.