Gyazo Breach Exposes 23.6 Million User Records and Image Metadata

Helpfeel, the Japanese company behind the Gyazo screenshot and screen-recording service, says attackers accessed approximately 23.62 million user records after exploiting a vulnerability in Gyazo’s image upload server on 11 September 2026. The attacker was able to run malicious commands and reached a database before access was blocked the following day.

Exposed information may include names or nicknames, email addresses, password hashes, user and device IDs, login session IDs, X integration tokens, Google SSO email addresses, profile details, registration and last-login times, subscription and billing status, and usage statistics. Anonymous accounts without registered email addresses were also affected. Helpfeel said payment card information, including credit card numbers, was not exposed.

The incident also involved metadata for about 490 million images, mainly images uploaded in or before January 2019, plus metadata from 2.4 million additional images accessed through specific searches. This may include image IDs, upload IP addresses, User-Agent data, EXIF location information, OCR text, titles, source URLs, hashed passphrases and other metadata. Helpfeel said some information could potentially be used to reconstruct Gyazo URLs, and confirmed that a list of private images was obtained.

It has not confirmed that image files were stolen, but cannot rule out that some private images were viewed. The company says it has blocked the access routes and fixed the exploited vulnerability. Its investigation continues, with notifications planned by email or through the Gyazo interface. Users are being asked to change Gyazo passwords, particularly where passwords are reused, and to remain alert for suspicious messages.