Gyazo breach exposes 23.6 million accounts, including session IDs and X integration tokens
An attacker reached Gyazo's database through its image upload server and took 23.62 million user records: emails, password hashes, login session IDs, device IDs and X integration tokens, plus 490 million image metadata records.
Helpfeel, the Kyoto company behind the screenshot service Gyazo, disclosed on September 16 that an attacker exploited a vulnerability in Gyazo's image upload server, ran commands on its systems and accessed the Gyazo database. The intrusion was detected on the evening of September 11, Japan time, and blocked and patched early on September 12. About 23.62 million user records were exposed, including email addresses, password hashes, user and device IDs, login session IDs, X (Twitter) integration tokens and Google sign-in email addresses. A further 490 million image metadata records, mostly from 2019 or earlier, included upload IP addresses, EXIF location data and OCR-extracted text. Helpfeel has asked every user to change their password and says it invalidated or restricted the exposed authentication data, without specifying which. It has not disclosed the password hashing algorithm.
Why it matters
The password reset is the least important part of this list. Session IDs and third-party integration tokens are live credentials in their own right: a stolen session skips the password and any MFA entirely, and a password change only helps if the service also kills existing sessions. Helpfeel says it invalidated exposed authentication data but not which kinds, so affected users should sign out of every session, and anyone who connected Gyazo to X should revoke that app from X's connected-apps settings rather than wait for Helpfeel to confirm.
For everyone else, the lesson is about what your own breach notice would be able to say. If session identifiers and OAuth tokens sit in the same database as the user table, one database read yields replayable access. Hash or encrypt session identifiers at rest, store third-party tokens separately and encrypted, and make "revoke every active session" a single operation you can run in an incident. With the hash algorithm undisclosed, assume these hashes will be cracked and feed credential stuffing elsewhere. See session cookie theft.
Source: The Hacker News
Related on Start with Identity
- BlogDreamHost says File Manager attacker took FTP passwords and webmail sessions for about ten weeks
DreamHost's breach notice, filed with California's attorney general, says an attacker who exploited its web File Manager captured the FTP/SFTP credentials of ev
- BlogChick-fil-A's second credential stuffing breach in three years hit 13,322 loyalty accounts
Automated login attempts using credentials obtained from a third-party source, not a Chick-fil-A breach, compromised 13,322 Chick-fil-A One loyalty accounts ove
- BlogDigiCert says self-registered accounts read archived customer data, including some ID documents
DigiCert is notifying customers that an unauthorized, self-registered account read archived customer records from an internal business system between June 27 an
- CVEZammad session hijack zero-day that led to remote code execution
A session hijack flaw in Zammad 6.3.0 to 6.5.4 gave attackers code execution as the zammad user. It was exploited against DIVD before disclosure. CISA KEV on Oc
- RecipeBreak-glass (emergency access) accounts in Microsoft Entra ID
Set up at least two cloud-only emergency access accounts on the onmicrosoft.com domain with a permanent Global Administrator assignment and FIDO2 passkeys, excl
- CVECitrix Bleed, session-token leak from NetScaler ADC
A buffer over-read on NetScaler ADC/Gateway leaked session tokens in the clear. Attackers replayed them and skipped the login, including MFA. CISA KEV. October