A server flaw, not a stolen password
Helpfeel, the Japanese company behind the screenshot and image-sharing tool Gyazo, has confirmed that an attacker broke in through a flaw in its image upload server rather than by guessing or phishing a password. Once inside, the attacker was able to run commands on the server and reach the underlying database directly. Helpfeel has not published the exact technical nature of the flaw. Gyazo is a widely used tool for capturing and instantly sharing screenshots, with roughly 23 million registered users relying on it for quick, informal sharing rather than as a place to store sensitive files, which is part of why this breach is worth taking seriously even though it targets a screenshot tool rather than a bank.
The intrusion happened on the evening of September 11, 2026, Japan time. Helpfeel says it noticed the suspicious activity that same evening and had blocked the attacker's access and patched the vulnerability by early the next morning. That is a fast response, but it did not stop roughly 23.62 million user records and metadata tied to about 490 million images from being read before the door closed.
What was actually taken
The 23.62 million figure covers every account record the attacker reached, including a large number of anonymous accounts that were never tied to a registered email address. Helpfeel says it is still working out how many real individuals that represents.
For accounts that were identifiable, the exposed data includes names or nicknames, email addresses, password hashes, user and device identifiers, login session identifiers, X (formerly Twitter) integration tokens, Google single sign-on email addresses, profile details, language settings, registration and login dates, subscription plan, and billing status. Helpfeel says payment card numbers were not stored on the affected systems and were not exposed. The login session identifiers and X integration tokens in that list are worth flagging on their own, since a valid session identifier can sometimes let an attacker step into an already-logged-in account without needing a password at all, and a stolen integration token can grant access to a connected X account depending on the permissions originally granted.
Separately, the attacker accessed roughly 490 million records of image metadata, most of it tied to images uploaded before January 2019. That metadata includes image identifiers, the internet protocol (IP) address and browser identifying string used at upload time, embedded EXIF (Exchangeable Image File Format) location data from photos, text extracted from images through optical character recognition (OCR), image titles, source uniform resource locators (URLs), and hashed passphrases that were set on some private images.
Why the image metadata matters more than it sounds
Gyazo links work like most quick-sharing tools: an uploaded image gets a long, effectively unguessable identifier, and anyone who has that identifier can view the image without logging in. That identifier is the only thing standing between a private screenshot and anyone who finds the link. Because the leaked metadata includes those identifiers alongside titles and extracted text, it gives an attacker a searchable index into images their owners never intended to share widely, even without touching the image files themselves. Helpfeel says a subset of roughly 2.4 million images was accessed directly under specific filtering criteria, on top of the metadata exposure.
Timeline and response
Helpfeel confirmed the scope of the exposure internally on September 14, reported the incident to Japan's Personal Information Protection Commission on September 15, and published a public notice on September 16. The company has forced password resets for affected accounts, temporarily disabled viewing for some stored captures, brought in outside forensic investigators, and apologized to users for the disruption.
What this means for you
If you have a Gyazo account, change your password now, and change it anywhere else you reused the same one, since the stolen data includes password hashes that can eventually be cracked offline. Treat any unexpected email or message that references your Gyazo account, images, or billing details with suspicion, since the leaked profile and billing data gives scammers enough detail to make phishing attempts look legitimate. If you ever uploaded screenshots containing sensitive personal or financial information and relied on the link being hard to guess, assume that assumption no longer holds and remove or replace those images where you can.
