Reporting snapshot: September 20, 2026. Facts may change as investigations continue.
1. Gyazo confirms exposure of user records and image metadata
Helpfeel confirmed that an attacker exploited a vulnerability in Gyazo's image-upload server on September 11 and executed commands on its systems. The company reported unauthorized disclosure of approximately 23.62 million user-related records, about 490 million image-metadata records primarily associated with images registered before January 2019, and another approximately 2.4 million metadata records retrieved under narrower criteria.
The exposed fields varied by user and may include email addresses, password hashes, session identifiers, device identifiers, profile information, and linked-service data. Image metadata may include upload IP addresses, EXIF location data, OCR text, and information used to construct image URLs. Helpfeel said payment-card information was not exposed and that it blocked the access path and fixed the exploited vulnerability.
What to do: Change the Gyazo password and any reused or similar password elsewhere. Review connected-app access for linked X or Google accounts, watch for messages exploiting the incident, and reach Gyazo through its official site instead of an email link.
Original source: Helpfeel incident notice, September 16, 2026
2. Revolut discloses customer data after fraudulent government requests
Revolut confirmed that it released sensitive customer information after fraudulent information requests appeared to come from a legitimate government-agency email domain. The company said its internal systems and customer funds were not compromised. Reuters reported that Revolut notified affected customers and was working with authorities; later reporting put the affected group at roughly 680 customers, while the investigation and extortion claims continued.
Why this matters: The attacker did not need to break the bank's internal systems. The breach came through a trusted request process. Technical controls still need a human verification path for unusual or high-impact data disclosures.
What to do: Affected customers should use the Revolut app or independently verified support channels, monitor account and identity activity, and treat messages containing accurate personal details as untrusted until verified through a second channel.
Reporting and company confirmation: Reuters, September 12, 2026
3. One compromised CRM sends risk across the charity sector
Beacon CRM detected suspicious access on July 29. Public incident statements from affected organizations say compromised credentials were used to access the service and copies of customer database backups were made. More than 1,500 charities use Beacon, but the data held by each organization differs and the exact records accessed were not always identifiable.
Organizations including Wikimedia UK and the RNLI warned supporters that contact details and records of interactions may have been involved. Public reporting said there was no confirmed misuse at the time of disclosure. An attacker's claim that copied data was deleted is not independently verifiable and should not replace normal breach precautions.
What to do: If a charity sends you a notice, read the named data types carefully. Be alert for donation, membership, or support messages that use familiar details to build trust. Verify the charity through its official website before paying, signing in, or sharing more information.
Affected-organization statement: Wikimedia UK, August 6, 2026
Current reporting: The Guardian, September 20, 2026
Panther Note
These incidents entered through three different doors: a software vulnerability, a trusted request process, and a third-party provider. The lesson is not “trust nothing.” It is to verify high-impact actions, limit what each system can expose, and plan for a partner's failure as seriously as your own.