Gyazo server flaw exploited to steal 23.6 million user records

The Gyazo image-sharing platform has confirmed it suffered a data breach after hackers exploited a server vulnerability that allowed them to steal 23.6 million user records.

Gyazo is a cloud-based screenshot and screen-recording tool operated by Helpfeel that automatically uploads user screen captures to the cloud and gives them a shareable link to share on chats, forums, social media, etc.

It's especially popular in gaming communities and claims 23 million users worldwide, who have submitted 3.1 billion media items.

According to an announcement by the company, the incident occurred on September 11, 2026, allowing attackers to access its database and obtain approximately 23.62 million user records.

The company has now taken the platform offline while it conducts maintenance.

"Currently, the Gyazo service is temporarily suspended for maintenance as a preventive measure. We sincerely apologize for any inconvenience caused. Please wait a little longer until recovery," reads a post on X.

The company detected the suspicious activity on September 12 and fixed a vulnerability the attackers used to breach the platform, but by then, the data had already been stolen.

"Our subsequent investigation confirmed that the third party had accessed Gyazo's database and that user information and metadata associated with uploaded images had been disclosed without authorization," confirmed Gyazo in a statement published earlier this week.

Based on Gyazo's investigation, the data that has been exposed varies per user and may include one or more of the following:

• Names/nicknames
• Email addresses
• Password hashes
• User and device IDs
• Login session IDs
• X integration tokens
• Google SSO email addresses
• Profile details
• Subscription information
• Billing status
• Usage statistics

The exposed dataset includes anonymous account records, though Gyazo did not share what percentage those represent.

The platform also stated that the incident exposed 490 million image metadata records, most associated with images uploaded to the service before January 2019.

These metadata include image IDs used to construct image URLs, upload IP addresses, User-Agent strings, EXIF location data, OCR-extracted text, image titles, source URLs, and hashed passphrases for private images.

Helpfeel notes that image IDs can potentially be used to access the corresponding content, which is why the company has temporarily disabled access to files whose records were exposed.

Additionally, it stated that the hackers also obtained a list identifying private images, and the company cannot rule out that some were viewed.

The firm said its investigation has not found signs of data being deleted due to this incident.

The company also found no evidence that its other Helpfeel and Cosense services had data stolen.

The firm is notifying affected users directly as they conduct an investigation with external experts, and have contacted the authorities.

All Gyazo users are advised to change their passwords on the service and other platforms where they use the same credentials, and remain alert for suspicious communications.