Gyazo breach: 23.6 million user records stolen, TASK#STOMP steals corporate documents

Data breach at Gyazo: 23.6 million user records stolen

On September 21, 2026, Helpfeel, the Japanese company behind the Gyazo screenshot-sharing platform, confirmed a data breach affecting 23,62 million user records. Attackers exploited a vulnerability in the image upload server to access sensitive information and metadata linked to hundreds of millions of images uploaded to the platform.

Quick Response

Technical details of the vulnerability

The vulnerability exploited was not specified in Helpfeel's official statement, but the nature of the attack suggests a security issue in upload management. This type of vulnerability is often related to insufficient validation of uploaded files or server configuration errors.

Impact of the breach

The impact of the breach is significant: the stolen data includes users' personal information and metadata that could be used for cyberstalking, targeted phishing, or other information-based attacks. The Gyazo platform is widely used for real-time screenshot sharing, making the stolen data particularly sensitive.

Incident response and cyber insurance

Following the breach, Helpfeel launched an in-depth investigation and collaborated with relevant authorities. This type of incident underscores the importance of an effective incident response and adequate cyber insurance. Companies handling sensitive data must be prepared to quickly respond to such breaches to mitigate damage.

Compliance with regulations

The Gyazo breach also raises questions regarding NIS2 compliance and other data protection regulations. Companies must ensure their systems are protected from known vulnerabilities and have adequate incident management procedures. Non-compliance can result in severe penalties and reputational damage.

TASK#STOMP: the backdoor that steals corporate documents

Researchers have analyzed TASK#STOMP, a Windows backdoor that searches for corporate documents on victims' disks, uploads them to attacker-controlled servers, and remains active to steal any new documents created or modified. This malware is particularly dangerous as it combines various data theft techniques, including stealing saved Wi-Fi passwords, copying text from the clipboard, and capturing screenshots.

Advanced features of TASK#STOMP

In addition to stealing documents, TASK#STOMP can execute commands sent by the attackers' operators. This makes it a versatile tool for remote control of infected machines. Its ability to steal Wi-Fi passwords and text from the clipboard makes it particularly effective for credential theft and other sensitive information.

Impact on corporate environments

The presence of TASK#STOMP in a corporate environment can have serious consequences. The theft of corporate documents can lead to loss of proprietary information, privacy violations, and financial damage. Companies must implement Data Loss Prevention (DLP) and Security Information and Event Management (SIEM) solutions to detect and mitigate such threats.

Protection against TASK#STOMP

To protect against TASK#STOMP, companies must adopt a multi-layered approach that includes identity and access management (IAM), network segmentation, and the use of Managed Detection and Response (MDR) solutions. It is crucial to keep systems updated and conduct regular penetration tests to identify and correct vulnerabilities.

Other developments in cybersecurity

Meanwhile, other relevant news includes the rise in artificial intelligence spending in Europe, which is expected to reach nearly $470 billion by 2030, and the increase in malicious activities by AI bots on e-commerce sites. These trends underscore the importance of investing in cloud security posture and zero trust architecture to protect critical infrastructures.

The threat of deepfakes

A recent Gartner survey revealed that 41% of CISOs reported at least one social engineering incident involving deepfakes during an audio call in the last 12 months. This type of attack represents a new challenge for companies, which must adopt advanced breach remediation and incident response solutions to address these emerging threats.

The Gyazo breach and the emergence of threats like TASK#STOMP highlight the need for a proactive approach to cybersecurity. Companies must invest in advanced technologies, adopt security best practices, and ensure compliance with current regulations to protect their data and infrastructures.