Loading story…
Helpfeel disclosed a breach of its Gyazo image-sharing service that exposed approximately 23.62 million user records, including email addresses and password hashes. The incident also exposed roughly 490 million image-metadata records, primarily associated with images uploaded in January 2019 or earlier.
The metadata included identifiers used in Gyazo image URLs, potentially enabling unauthorized viewing of affected images. Helpfeel temporarily disabled access to certain impacted images and instructed all Gyazo users to reset their passwords, especially passwords reused on other services; the company has not disclosed the intrusion method, breach timeframe, responsible actor, or broader notification details.
See attribution, scope, and your downstream exposure.
2 events from the most recent confirmed update back to the earliest known activity.
After detecting suspicious activity, Helpfeel blocked identified access paths, terminated the attacker’s connections, and patched the unspecified vulnerability in Gyazo’s image-upload server. The flaw had enabled arbitrary command execution and access to the Gyazo database.
Helpfeel disclosed a breach affecting its Gyazo image-sharing service, exposing approximately 23.62 million user records containing email addresses and password hashes and roughly 490 million image-metadata records. The metadata, primarily for images from January 2019 or earlier, included image-link identifiers that could enable unauthorized viewing; Helpfeel temporarily disabled some affected image views and told users to reset passwords.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcedatabreaches.net
Open sourcemkd-cirt.mk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and media reports disclosed enormous troves of exposed login data, including an unprotected 47.42 GB database containing **184,162,718** unique usernames and passwords tied to services such as Microsoft, Facebook, Google, Instagram, Snapchat, Discord, Netflix, PayPal, and government portals in 29 countries. Security researcher Jeremiah Fowler found the database on an unmanaged server with no password protection or encryption, and sample records included account types, website URLs, and plaintext passwords labeled `senha`. Fowler said multiple individuals confirmed the leaked credentials were genuine after he contacted them directly. The exposed records are believed to be linked to **infostealer malware** and broader malware-as-a-service collection operations, with subsequent reporting describing a far larger cache totaling **16 billion** credentials affecting major consumer platforms including Apple, Facebook, and Google. The disclosures raise immediate risks of credential stuffing, account takeover, phishing, fraud, and unauthorized access to corporate and government systems. Public access to the 184 million-record database was later restricted after responsible disclosure to the hosting provider, but the owner of the data remains unidentified.
Jun 29, 2026
Flickr notified users of a **potential data breach** after discovering a vulnerability in a **third-party email service provider** system that may have enabled unauthorized access to some member information. Flickr said it was alerted to the flaw on **February 5, 2026** and disabled access to the affected system within hours. The company did not name the provider or disclose how many users were impacted, but stated that exposed data may include **real names/usernames, email addresses, account types, IP addresses, general location data, and account activity**. Flickr stated that **passwords and payment card data were not compromised**, reducing immediate risk of direct account takeover but increasing risk of **phishing and targeted social engineering** using the exposed profile and activity details. Users were advised to review account settings for unexpected changes and to be cautious of messages referencing their Flickr accounts, with Flickr emphasizing it will not request passwords via email. Separately, Substack reported a different breach involving unauthorized access to limited user data and dark web leak claims; it is not connected to the Flickr incident.
Jun 29, 2026
A publicly accessible database containing **~149.4 million unique usernames and passwords** (about **96GB** of data) was discovered online by security researcher **Jeremiah Fowler**. The trove included not just credential pairs but also associated site links, indicating it was designed to enable direct account access across many services; major concentrations included **Gmail (48M)**, **Facebook (17M)**, **Instagram (6.5M)**, **Yahoo (4M)**, **Netflix (3.4M)**, **Outlook (1.5M)**, **iCloud (900K)**, and **Binance (420K)**. The database was reportedly **not encrypted and not password-protected**, and it also contained credentials tied to **.gov domains** from multiple countries, raising risks of follow-on activity such as spearphishing, impersonation, and potential access attempts against government networks. Fowler reported the exposure to the hosting provider, and the database was subsequently **removed for terms-of-service violations**; Fowler said he could not determine who owned or operated the dataset. Reporting indicates the database likely aggregated logs from **infostealer malware**, which commonly uses techniques like **keylogging** to capture credentials from infected devices; Fowler noted the dataset continued to **grow over roughly a month** while he worked to reach the host. The hosting arrangement was described as a global provider using regional affiliates, with the exposed instance attributed to an affiliate in **Canada**, and the provider was not publicly named.
Jun 29, 2026