Gyazo Data Breach Exposes 23.6 Million User Records and 490 Million Image Metadata Records

What happened in the Gyazo data breach?

The Gyazo data breach began when a third party exploited a vulnerability in Gyazo’s image-upload server on September 11, 2026. Helpfeel, the company behind Gyazo, says the attacker gained unauthorized access and executed arbitrary commands on the affected server. Arbitrary command execution is serious because it can allow an intruder to run actions on a compromised system rather than merely view a limited set of files.

Helpfeel says it blocked the identified access routes, terminated the attacker’s connections, and remediated the exploited vulnerability by the early hours of September 12. The company publicly disclosed the incident on September 16, after assessing the affected data. Helpfeel’s breach notice provides the company’s current account of the intrusion and mitigation work.

The most important limitation is that containment does not reverse access that occurred before the attacker was removed. Users should therefore focus on reducing follow-on account risks, especially where a Gyazo password was reused or a Google or X account was connected to the service.

What Gyazo user information was exposed?

The Gyazo data breach exposed approximately 23.62 million user records, according to Helpfeel. That total includes records associated with anonymous accounts, so it is not necessarily a count of 23.62 million distinct people. The distinction matters because one person can create or use more than one record, while anonymous records may not identify an individual directly.

The exposed account information can include names or nicknames, email addresses, password hashes, user IDs, device IDs, login-session IDs, profile information, last-login details, subscription plans, billing status, and usage statistics. Password hashes are not the same as plaintext passwords, but they still create risk if attackers attempt to crack weak passwords or use related information in phishing campaigns.

The exposed data can also make targeted scams more convincing. An attacker who knows that an account had a paid plan or recent login activity can create a more believable message about billing, account verification, or an alleged security check. Users who have received breach-related emails should compare the sender address carefully and avoid opening links in unexpected messages. CISA’s phishing guidance recommends recognizing and reporting suspicious messages. Similar risks appeared after a wallet-user email breach, where stolen contact data created an opening for targeted phishing attempts.

What image metadata may have been exposed?

The Gyazo data breach exposed roughly 490 million image-metadata records, mostly relating to images registered on or before January 2019. Helpfeel also identified metadata for another roughly 2.4 million images retrieved under narrower filters. Image metadata is separate from the image file itself, but the metadata can still reveal sensitive context about an upload.

The exposed metadata can include image IDs used to construct image URLs, upload IP addresses, browser user-agent strings, EXIF location information where present, OCR text, image titles, source URLs, and hashed passphrases used for private images. OCR text refers to text recognized within an image, such as a document heading, a receipt detail, or a message captured in a screenshot.

Location data creates a particular privacy concern because EXIF metadata can contain geographic information when a device saved it in the original image. Source URLs and OCR text can also reveal workplace systems, private web pages, account names, or other details that were visible when a screenshot was captured. The practical response is to assume that older Gyazo uploads containing personal, workplace, financial, or location-sensitive information may need review.

Were private Gyazo images exposed?

Private Gyazo images may have been viewed, and Helpfeel says it cannot rule out that possibility. The company says the attacker obtained a list that identified private images, which means the incident involves more than ordinary account information and public-image metadata. Helpfeel temporarily disabled viewing for some images to prevent additional harm while it investigates.

The available information does not establish that every private image was accessed or copied. However, users should not treat private status as proof that a past upload remained inaccessible during the incident. Private screenshots can contain passwords, recovery codes, internal work information, customer data, personal conversations, medical details, or financial documents.

The safest approach is to review the kinds of images uploaded to Gyazo, beginning with older screenshots and images shared through links. Remove or replace exposed credentials immediately if any upload displayed passwords, API keys, access tokens, recovery codes, or confidential information. Contact an employer’s IT or security team before attempting to handle company data alone, especially if screenshots included internal systems or customer information.

What should Gyazo users do now?

Gyazo users should change their Gyazo password immediately and change every reused or similar password on other services. Helpfeel specifically asks all users to take that action because password hashes were among the potentially exposed information. A unique password reduces the chance that a breach at one service can be used to enter another account.

1. Change your Gyazo password to a new, unique password stored in a reputable password manager.
2. Replace reused or closely related passwords on email, social media, work, and financial accounts.
3. Review Google and X security settings if you connected either service to Gyazo.
4. Check active sessions and sign out of devices you do not recognize where the service provides that option.
5. Review older Gyazo uploads for screenshots containing credentials, personal data, location details, or confidential work material.
6. Watch for phishing messages that reference Gyazo, billing status, image links, password resets, or account recovery.

Gyazo users should secure their primary email account first if the same password was reused there. Email access can enable password resets on many other services, which is why a compromised inbox often creates broader account risk. Users who want a more private messaging setup may also be interested in phone-number-free account registration, although changing a compromised password remains the immediate priority.

Stop and contact an employer’s security team, a service provider, or a qualified incident-response professional if you uploaded corporate credentials, customer records, financial documents, or highly sensitive personal information. A normal user can change passwords and review sessions, but an organization may need to rotate access keys, invalidate tokens, notify affected parties, or preserve evidence for an internal investigation.

Were payment cards or billing details exposed?

Payment card information, including credit-card numbers, was not exposed in the Gyazo data breach, according to Helpfeel. The company does list subscription plans and billing status among the information that may have been exposed, so users could still receive convincing fraud attempts that refer to a paid account or billing issue.

The absence of card numbers lowers the risk of direct card fraud from this incident, but it does not eliminate fraud risk. Attackers can use account details to send fake renewal notices, refund offers, invoice alerts, or payment-verification requests. The practical response is to open Gyazo only through a known address or saved bookmark instead of following a billing link in an email or text message.

Users should also review bank and card activity as part of ordinary account security, especially if they receive a suspicious payment message. Contact the card issuer through the phone number on the card or the issuer’s official app if an unfamiliar charge appears. Do not provide card numbers, verification codes, or passwords to anyone claiming to be support through an unsolicited message.

How can users reduce image-sharing privacy risks after the breach?

Image-sharing privacy risks can be reduced by limiting what appears in screenshots before an upload and removing unnecessary metadata from original photos. Screenshots often capture more than the intended detail, including browser tabs, email addresses, account balances, internal URLs, notification previews, and recovery information. The Gyazo incident shows why a private link or private-image setting should not be treated as a permanent security boundary.

Users should crop screenshots before sharing and redact passwords, QR codes, API keys, account numbers, home addresses, and location details. Images from phones can also contain EXIF metadata, including location data where present. A quick review before uploading is more reliable than trying to remove exposure after an image link has already been shared.

Users should also separate personal and workplace sharing habits. Company screenshots can expose systems, customer information, source URLs, or security controls that are not obvious at first glance. Businesses reviewing their processes may benefit from a structured audit process for identifying where sensitive information appears across public-facing workflows.

What is the current status of Gyazo after the breach?

Gyazo says it blocked the identified access routes and remediated the exploited vulnerability by September 12, 2026. The company also says newly uploaded images resumed delivery after the mitigations, while its investigation and user-notification process continue. Reporting on the ongoing response notes that the service resumed new image delivery after the mitigation work.

The current service status does not change the need to secure old credentials and review sensitive uploads. A restored upload function indicates that the company has resumed operations, but it does not establish that historical data copied during the intrusion can be recovered or deleted from an attacker. Users should make account-security decisions based on the exposed data categories rather than waiting for a final investigation update.

Gyazo users should follow official account notices for future updates and avoid relying on social media posts or unsolicited support messages. Security incidents often generate secondary scams, particularly when attackers can use exposed email addresses, account details, or image-related language to make messages appear legitimate.

FAQ

How many people were affected by the Gyazo data breach?

Gyazo says approximately 23.62 million user records were exposed, but that total includes anonymous-account records and does not necessarily equal the number of distinct people affected. Helpfeel has not presented the figure as a unique-user count.

Did the Gyazo breach expose passwords?

Gyazo says password hashes may have been exposed, rather than plaintext passwords. Change your Gyazo password and any reused or similar passwords because weak hashes can sometimes be cracked and reused passwords can expose other accounts.

Did the Gyazo breach expose private images?

Gyazo says it cannot rule out that some private images were viewed because the attacker obtained a list identifying private images. Review past uploads for exposed credentials or sensitive information and replace any secrets visible in those images.

Did the Gyazo breach expose credit-card numbers?

Gyazo says payment information, including credit-card numbers, was not exposed. Billing status and subscription-plan information may still have been exposed, so remain alert for fake billing and renewal messages.

Should Gyazo users disconnect Google or X accounts?

Gyazo users should review connected Google and X accounts because Google SSO email addresses and X integration tokens may have been exposed for users who connected those services. Change passwords, review active sessions, and revoke unfamiliar access through the connected service’s security settings.