Gyazo breach exposed metadata for 490 million images

A breach at screenshot-sharing service Gyazo exposed nearly 24 million customer records and an additional 490 million image-metadata records, Infosecurity Magazine reported. Attackers exploited an upload-server vulnerability, gaining data that included image IDs, source IP addresses, location information, extracted text, source URLs and hashed passphrases. Developer Helpfeel said some metadata could be used to construct image URLs and view corresponding images without authorization, prompting it to disable access to some images temporarily. The company remediated the vulnerability and urged password changes. Much of the affected image data dates from January 2019 or earlier, reducing the usefulness of some exposed credentials.