Gyazo breach exposes 23.6 million user records and 490 million image metadata entries

Helpfeel, the Kyoto-based company behind the screenshot-sharing tool Gyazo, has confirmed that an attacker exploited a server vulnerability and accessed its database, taking roughly 23.62 million user records [1][2]. SecurityWeek reports the flaw was in the service’s image upload server [3].

The company says the intrusion happened on 11 September 2026, was detected the following day, and that the vulnerability was fixed after detection — but the data had already been copied by that point [1]. Gyazo has been taken offline as a precaution while maintenance work continues [1].

Alongside the user records, Helpfeel says about 490 million image metadata records were exposed, most of them tied to images uploaded before January 2019 [1][2]. That second number is the part defenders and privacy-minded users should read twice.

Who is affected

Anyone with a Gyazo account, and anyone whose screenshots were uploaded through the service — including via anonymous accounts, which Helpfeel confirms are in the exposed dataset without saying what share of it they represent [1].

Gyazo is widely used in gaming and technical communities for quick screen captures shared as links. The company claims 23 million users and 3.1 billion media items [1], which puts the 23.62 million record count in the range of its entire user base.

Helpfeel says it found no evidence that data was deleted, and no evidence that its other products, Helpfeel and Cosense, lost data [1]. Users are being notified directly, external experts are involved, and authorities have been contacted [1].

What was in the data

The two datasets are described separately in the disclosure. The Hacker News reports the user records include email addresses and password hashes [2], and Helpfeel says the exact fields vary per user [1]. The hashing algorithm used is not stated in any of the sources, so it is not possible to judge how quickly those hashes could be cracked.

The second dataset — the 490 million image metadata records — is broader and, in some ways, more sensitive than the account data. BleepingComputer, summarising Helpfeel’s notice, lists the following among the exposed metadata fields [1]:

• upload IP addresses and User-Agent strings
• EXIF location data
• text extracted from images by OCR
• source URLs and image titles
• hashed passphrases for private images
• image IDs, which are the component used to build Gyazo image URLs

Two items matter more than the rest. First, Helpfeel says image IDs can potentially be used to reach the corresponding content, which is why it has temporarily disabled access to files whose records were exposed [1]. Second, OCR-extracted text means the searchable contents of screenshots may be in the dump, not just pointers to them. Screenshots routinely contain tokens, invoices, private messages, internal dashboards and email threads. A searchable index of that text is a different class of exposure than a list of email addresses.

Helpfeel also says the attacker obtained a list identifying which images were private, and that it cannot rule out that some private images were viewed [1].

What the sources do not establish

The enrichment data we have for this incident lists no CVE identifier for the exploited vulnerability, and none of the sources describe its class beyond its location in the image upload path [3]. There is also no attribution, no indication of whether the data has appeared for sale, and no timeline for restoring access to the affected files.

Importantly, none of the sources say whether the image metadata records can be correlated back to individual accounts or email addresses. The user records and the metadata records are described as distinct datasets; whether they are joinable in the attacker’s hands is unknown. The full field-by-field list of what each user record contained is referenced in Helpfeel’s notice but is not fully reproduced in the sources available here.

What to do

• Change your Gyazo password now, and change it anywhere you reused that password. Credential reuse is the most immediate downstream risk from a dump containing email addresses plus password hashes [1][2].
• Treat screenshots you uploaded to Gyazo before January 2019 as potentially reachable. Helpfeel says image IDs can potentially be used to access the corresponding content and has disabled access to affected files [1]. Rotate any credential, API key, token or recovery code you can recall capturing in a screenshot. OCR text was in the exposed metadata [1], so “nobody would bother reading my old screenshots” is not a safe assumption.
• Audit your own Gyazo history if you used it in a work context. Pasted config files, admin panels and ticket views are common screenshot subjects. Treat anything sensitive you find as disclosed.
• Treat Gyazo links in your documentation as untrusted for now. Access to affected files is disabled [1]; expect broken links, and do not assume a working link means the file was unaffected.
• Watch for targeted phishing. Email addresses are in the user dataset [2], and Helpfeel has advised users to stay alert to suspicious communications [1]. Whether attackers can pair those addresses with the richer image metadata is not established by the sources.
• If your organisation depends on Gyazo, plan for continued downtime and consider whether screenshots of internal systems should be flowing to a third-party cloud service automatically at all.