Gyazo breach exposes 23.6 million user records and 490 million image metadata

September 21, 2026 at 01:57 PM3 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Japanese software firm Helpfeel confirmed a data breach on its Gyazo screenshot platform, exposing 23.62 million user records and metadata for 490 million images. Attackers exploited a vulnerability in an upload server on September 11, gaining unauthorized access and running arbitrary commands. The company blocked access by September 12 and reported the incident to Japan's Personal Information Protection Commission on September 15.

Key Facts

The breach exposed 23.62 million user records including names, email addresses, password hashes, user IDs, device IDs, login session IDs, X integration tokens, Google SSO email addresses, profile information, language preferences, registration and login timestamps, subscription plans, and billing status.
Approximately 490 million image metadata records were exposed, mostly tied to images uploaded in or before January 2019, representing about 14.4% of all image data on the platform.
An additional 2.4 million images were separately pulled through specific filtering, with metadata including image IDs, upload IP addresses, user agents, EXIF location data, OCR text, image titles, source URLs, and hashed passphrases for private images.
Helpfeel confirmed no payment information, including credit card numbers, was disclosed without authorization.
The company reported the incident to Japan's Personal Information Protection Commission on September 15 and plans to notify affected users by email or through the Gyazo web interface for anonymous accounts.

Breach Discovery and Response

An attacker exploited a vulnerability in Gyazo's image upload server on September 11 to gain unauthorized access and run arbitrary commands. Suspicious activity was detected that same evening, and by the early hours of September 12, access routes had been blocked and the attacker's connections cut off. Helpfeel's subsequent investigation confirmed that a third party had accessed Gyazo's database and that user information and image metadata had been disclosed without authorization. The company reported the incident to Japan's Personal Information Protection Commission on September 15. Helpfeel plans to notify affected users by email, and through the Gyazo web interface for anonymous accounts that have no registered email address.

Exposed Data and Privacy Risks

The stolen user records, around 23.62 million, include names, email addresses, password hashes, user IDs, device IDs, login session IDs, X integration tokens, Google SSO email addresses, profile information, language preferences, registration and login timestamps, subscription plans, and billing status. The image metadata is larger in scope, approximately 490 million records, tied mostly to images uploaded in or before January 2019, about 14.4% of all image data on the platform. An additional 2.4 million images were separately pulled through specific filtering, with metadata including image IDs used to build image URLs, upload IP addresses, user agents, EXIF location data where present, OCR text extracted from images, image titles, source URLs, and hashed passphrases protecting private images. Helpfeel confirmed that the third party obtained a list identifying private images, and the company cannot rule out the possibility that some private images may have been viewed by the third party. The affected metadata includes information used to construct Gyazo image URLs, which could be used by a third party to access and view corresponding images without authorization, prompting Helpfeel to temporarily disable viewing of some images.

Impact on Users and Services

Helpfeel's investigation found no sign that data was taken from its other two services, Helpfeel and Cosense. Some images embedded in those tools through Gyazo may still be unavailable, since Gyazo paused image delivery in response to the incident. Michael Bell, founder and CEO at Suzu Labs, said the incident could be bad news for developers and the projects they were working on. Bell explained that developers use Gyazo constantly to share terminal output, API keys, credentials in config files, internal application screenshots, and sensitive documents, and that the OCR feature extracted and stored all of that text. Helpfeel asks all Gyazo users to change their passwords and extends the same advice to any other account sharing the same or a similar password.