Helpfeel: unauthorized access to the Gyazo image sharing service

At Gyazo, the image sharing service of Kyoto-based Helpfeel, part of the video conversion step on the image upload server let outside input be run as server commands. An attacker used this to run arbitrary commands, connected to a database reachable from that server and sent large amounts of data out. Data on about 23.62 million accounts (about 5.62 million with email addresses and about 18.01 million anonymous) leaked, together with about 490 million image metadata records and about 174 million metadata records of deleted images. User data can include email addresses, password hashes and linked-service tokens. No payment data leaked. The service was suspended and restarted on 27 September. The October 21 final report also confirmed viewing or acquisition of 432 image files belonging to 133 users and about 2.4 million selectively retrieved metadata records. Account totals include anonymous accounts and are not a count of people.