Gyazo's operator, Helpfeel, confirmed that attackers gained unauthorized access by exploiting a vulnerability in the platform's image upload server. The company said the flaw allowed the theft of user records, according to BleepingComputer and SecurityWeek.
The exposed data includes roughly 23.6 million user records. The Hacker News gives a more precise count of 23.62 million and says the records contained email addresses and password hashes; SecurityWeek rounds the figure to 23 million. The three reports agree on the root cause but differ on the exact numbers.
The Hacker News also reports that about 490 million image metadata records were exposed, a detail not mentioned by the other two outlets. That discrepancy means the full scope of the breach may be broader than initially reported.