# Gyazo Breach Exposes 23.6 Million Accounts and 490 Million Images

Page: https://hirantha.me/blog/gyazo-breach-exposes-236-million-accounts-and-490-million-images
Published: 2026-09-26
Written by: hirantha.me Newsroom (AI-generated). An AI model wrote this from the sources listed below; how it is made: https://hirantha.me/about/newsroom
Topics: gyazo, data breach, helpfeel, password security, screenshot tool

> A hacked upload server let an attacker pull 23.6 million Gyazo account records and metadata for 490 million images.

## A server flaw, not a stolen password

Helpfeel, the Japanese company behind the screenshot and image-sharing tool Gyazo, has confirmed that an attacker broke in through a flaw in its image upload server rather than by guessing or phishing a password. Once inside, the attacker was able to run commands on the server and reach the underlying database directly. Helpfeel has not published the exact technical nature of the flaw. Gyazo is a widely used tool for capturing and instantly sharing screenshots, with roughly 23 million registered users relying on it for quick, informal sharing rather than as a place to store sensitive files, which is part of why this breach is worth taking seriously even though it targets a screenshot tool rather than a bank.

The intrusion happened on the evening of September 11, 2026, Japan time. Helpfeel says it noticed the suspicious activity that same evening and had blocked the attacker's access and patched the vulnerability by early the next morning. That is a fast response, but it did not stop roughly 23.62 million user records and metadata tied to about 490 million images from being read before the door closed.

## What was actually taken

The 23.62 million figure covers every account record the attacker reached, including a large number of anonymous accounts that were never tied to a registered email address. Helpfeel says it is still working out how many real individuals that represents.

For accounts that were identifiable, the exposed data includes names or nicknames, email addresses, password hashes, user and device identifiers, login session identifiers, X (formerly Twitter) integration tokens, Google single sign-on email addresses, profile details, language settings, registration and login dates, subscription plan, and billing status. Helpfeel says payment card numbers were not stored on the affected systems and were not exposed. The login session identifiers and X integration tokens in that list are worth flagging on their own, since a valid session identifier can sometimes let an attacker step into an already-logged-in account without needing a password at all, and a stolen integration token can grant access to a connected X account depending on the permissions originally granted.

Separately, the attacker accessed roughly 490 million records of image metadata, most of it tied to images uploaded before January 2019. That metadata includes image identifiers, the internet protocol (IP) address and browser identifying string used at upload time, embedded EXIF (Exchangeable Image File Format) location data from photos, text extracted from images through optical character recognition (OCR), image titles, source uniform resource locators (URLs), and hashed passphrases that were set on some private images.

## Why the image metadata matters more than it sounds

Gyazo links work like most quick-sharing tools: an uploaded image gets a long, effectively unguessable identifier, and anyone who has that identifier can view the image without logging in. That identifier is the only thing standing between a private screenshot and anyone who finds the link. Because the leaked metadata includes those identifiers alongside titles and extracted text, it gives an attacker a searchable index into images their owners never intended to share widely, even without touching the image files themselves. Helpfeel says a subset of roughly 2.4 million images was accessed directly under specific filtering criteria, on top of the metadata exposure.

## Timeline and response

Helpfeel confirmed the scope of the exposure internally on September 14, reported the incident to Japan's Personal Information Protection Commission on September 15, and published a public notice on September 16. The company has forced password resets for affected accounts, temporarily disabled viewing for some stored captures, brought in outside forensic investigators, and apologized to users for the disruption.

## What this means for you

If you have a Gyazo account, change your password now, and change it anywhere else you reused the same one, since the stolen data includes password hashes that can eventually be cracked offline. Treat any unexpected email or message that references your Gyazo account, images, or billing details with suspicion, since the leaked profile and billing data gives scammers enough detail to make phishing attempts look legitimate. If you ever uploaded screenshots containing sensitive personal or financial information and relied on the link being hard to guess, assume that assumption no longer holds and remove or replace those images where you can.

## Questions

**What happened in the Gyazo data breach?**
An attacker exploited a flaw in Gyazo's image upload server to run commands and access its database, taking about 23.6 million account records and metadata for around 490 million images.

**Was my Gyazo password stolen?**
Password hashes, not plain-text passwords, were exposed, but you should still change your Gyazo password and any account where you reused it, since hashes can eventually be cracked.

**Were my private Gyazo images exposed?**
The company says about 2.4 million images were accessed directly, and the leaked metadata includes the unique link identifiers that protect private images, which increases the risk that some could be viewed even though the image files themselves were not part of the main leak.

**Was my payment information taken?**
Helpfeel says payment card numbers were not stored on the affected systems and were not exposed, though billing status and subscription plan details were.

**What should I do right now?**
Change your Gyazo password and any other account using the same password, watch for phishing messages that reference your account or billing details, and remove or replace any sensitive screenshots you uploaded before 2019.

## Sources

- [Gyazo server flaw exploited to steal 23.6 million user records](https://www.bleepingcomputer.com/news/security/gyazo-server-flaw-exploited-to-steal-236-million-user-records/), BleepingComputer
- [Gyazo Breach Exposes 23.62 Million User Records and 490 Million Image Metadata Records](https://thehackernews.com/2026/09/gyazo-breach-exposes-2362-million-user.html), The Hacker News
- [23 Million User Records Compromised in Gyazo Data Breach](https://www.securityweek.com/23-million-user-records-compromised-in-gyazo-data-breach/), SecurityWeek