Gyazo breach exposes 23.62 million account records; 432 image files confirmed accessed
Gyazo’s breach affected account records and image metadata, including location data and extracted text. Some images were accessed. Change your Gyazo password and similar passwords elsewhere; review older images before restoring sharing.
If you have not changed your Gyazo password since the breach, change it now, along with any identical or similar passwords elsewhere. Review older images and their visibility settings before selecting “Resume delivery”. Be wary of breach-related messages: Helpfeel says its notification emails will not ask you to follow links or act on linked websites.
What’s happening
An attacker breached Gyazo’s upload server on 11 September, exposing account information and image metadata. Helpfeel reported approximately 23.62 million account records, including anonymous accounts; this is not a count of distinct people. Depending on the account, information included email addresses, password hashes and login session identifiers. Image metadata included location information, extracted text and identifiers that could enable image viewing. The reported scope includes approximately 490 million metadata records, a separately filtered 2.4 million records and 174 million records for deleted images. The final investigation could not verify the exact fields or record counts transmitted outside Gyazo. Helpfeel confirmed that 432 image files belonging to 133 users were viewed or obtained and notified those users. The server flaw was fixed on 12 September and service resumed on 27 September. As of 20 October, Helpfeel had confirmed no subsequent misuse or financial harm. Notifications, monitoring and security improvements continued.
- What
- Breach
- Affects
- Gyazo screenshot, video and image-sharing service
- Fixed in
- Nothing to patch
- Since
- 11 Sept 2026
Timeline
- Vendor revised
Helpfeel’s final report confirmed that 432 image files belonging to 133 users were viewed or obtained; those users had been individually notified. It also announced plans to notify approximately 57,000 contactable accounts potentially affected by the deleted-image metadata exposure.
- Update
Gyazo resumed service after security checks and additional safeguards. Older uploads were restricted to their owners, who could review each image before choosing “Resume delivery”.
- Vendor revised
Helpfeel added approximately 174 million metadata records for previously deleted images to the affected data. It clarified that the 23.62 million user records included approximately 18.01 million anonymous accounts and 5.62 million accounts with registered email addresses.
- Update
Helpfeel began emailing potentially affected registered users in stages. It also placed notices within Gyazo.
- Update
Helpfeel suspended Gyazo to prevent further harm and commissioned an external forensic investigation.
- Made public
Helpfeel disclosed approximately 23.62 million affected user records, 490 million image-metadata records and a separately retrieved set covering 2.4 million images. It warned that the metadata could allow unauthorised image viewing.
- New fix
Helpfeel blocked the identified intrusion routes, disconnected the attacker and fixed the exploited server vulnerability.
- UpdateNothing to patch
An attacker exploited Gyazo’s image-upload server and accessed its database. Helpfeel detected suspicious activity that evening.
Sources
- Notice Regarding Unauthorized Access to Gyazo: Investigation Results (Update 3)Helpfeel · 21 Oct 2026
- Notice and Apology Regarding a Data Breach Resulting from Unauthorized Access to GyazoHelpfeel · 16 Sept 2026
- Notice and Apology Regarding a Data Breach Resulting from Unauthorized Access to Gyazo (Update 2)Helpfeel · 25 Sept 2026
- Notice Regarding the Resumption of Gyazo ServicesHelpfeel · 26 Sept 2026
- Gyazo data breach leaves over 23 million user records exposed, includes half a billion metadata pointsCybernews · 21 Sept 2026
- 23 Million User Records Compromised in Gyazo Data BreachSecurityWeek · 18 Sept 2026