Sep 18, 2026 · 6 min read

Gyazo Breach Exposes 23.6M Accounts and Screenshot Text

An attacker went in through Gyazo's image upload server and left with account records plus 490 million rows of screenshot metadata, including the text Gyazo had read out of your captures and the IDs that open them.

If you ever pressed a hotkey to grab part of your screen and share a Gyazo link, your email address is probably in this breach. Helpfeel, the Kyoto company that runs Gyazo, published its notice on 16 September 2026. The account data is the usual breach haul. The screenshot metadata is not. Gyazo runs text recognition on captures, and that extracted text leaked too. People screenshot order confirmations, login codes, shipping addresses, and error pages full of email addresses every day.

Key Takeaways

Helpfeel says about 23.62 million Gyazo user records leaked, including email addresses, names, password hashes, device IDs, and login session data.
About 490 million image metadata records also leaked, mostly for images uploaded in or before January 2019, with upload IP addresses, EXIF location data, and OCR text pulled from the images.
The attacker exploited a vulnerability in Gyazo's image upload server on 11 September 2026, and Helpfeel says it blocked access and fixed the flaw by 12 September.
Helpfeel asks every Gyazo user to change their password, and to change it anywhere else they used the same or a similar one.
Leaked image IDs could let a third party open images without permission, so Helpfeel has temporarily disabled viewing of some images.

What Happened in the Gyazo Breach?

A third party broke into Gyazo through its image upload server, ran commands on Helpfeel's systems, and read the Gyazo database. In the words of Helpfeel's breach notice, the attacker "exploited a vulnerability in Gyazo's image upload server to gain unauthorized access to our systems and execute arbitrary commands." Helpfeel has not named the vulnerability or said whether it was previously known.

The timeline, per the notice and The Hacker News' summary, moved fast:

11 September, evening (Japan time): Helpfeel spots suspicious activity.
12 September, early hours: known access routes blocked, attacker connections cut, vulnerability fixed the same day.
14 September: data exposure confirmed.
15 September: report filed with Japan's Personal Information Protection Commission.
16 September: public notice published.

Five days from detection to disclosure is quick by breach standards. Helpfeel also says it will email affected users at their registered addresses, which matters for the phishing section below.

What Data Was Exposed?

Two separate datasets leaked: account records and image metadata. Helpfeel says the 23.62 million account records "include records for anonymous accounts with no registered email address," so the number of real email addresses is lower, though Helpfeel has not said by how much. The account side covers:

Email addresses, names, profile details, and language settings
Password hashes (the hashing algorithm has not been disclosed)
User IDs, device IDs, and login session IDs
X (Twitter) integration tokens and Google sign in email addresses, for accounts that connected them
Plan, billing status, registration and last login dates, and usage statistics

No card numbers or other payment information leaked, per Helpfeel. The company says it has applied "invalidation and restrictions" to the authentication data involved, without spelling out which tokens were revoked.

The image side is about 490 million metadata records, mostly for images registered in or before January 2019, which Helpfeel puts at 14.4% of all its image data. A further 2.4 million images had their metadata "separately retrieved using specific filtering criteria." Each record can hold the image ID, upload IP address, User-Agent, EXIF location, OCR text, title, source URL, and the hashed passphrase on private images. Helpfeel says it has not confirmed any loss of the image files themselves.

A laptop on a desk at dusk showing a blurred grid of screenshot thumbnails, with a smartphone and a coffee mug beside it in cool blue evening light

Why Is Screenshot Metadata So Sensitive?

Screenshot metadata is sensitive because OCR text is the screenshot, minus the pixels. Nobody needs to download a capture of your order confirmation if the database already holds the recognized text: your name, the delivery address, the email on the receipt. Pair it with the upload IP and an EXIF location on photos, and a single row can tie a person to a place and a moment.

Then there are the image IDs. Gyazo's own safety page says its links have 2 to the 128th power possible addresses and that "only you can see your captures, until you share the link." That is the whole privacy model for a default capture. It holds against guessing. It does not hold against someone who copied the list of IDs out of the database, which is why Helpfeel admits it "cannot rule out the possibility that some private images may have been viewed."

One piece of arithmetic worth doing: if 490 million records are 14.4% of Gyazo's image data, the full library is somewhere around 3.4 billion images. The attacker took the oldest slice, yet the database they reached covered far more. We saw a similar pattern with the ClarityCheck leak of 9 million face photos, where a supposedly private image service turned out to be one database query away from public.

Why Email Users Should Care

Your inbox is Gyazo's second factor. According to Gyazo's two step login help page, a login from a new IP address triggers a verification code "to your registered email address." So if you reused your Gyazo password on Gmail, a cracked hash unlocks both the account and the code that protects it. The FTC's 2FA guidance makes the same point about email codes: an authenticator app is safer because its passcode "isn't susceptible to a SIM card swap attack or to someone hacking your email."

The second risk is phishing. Helpfeel will send breach notices by email, and anyone holding the leaked list knows exactly which addresses to target with a fake one. The notice itself warns users to "remain vigilant for any suspicious emails, messages, or other communications related to this incident." Attackers with OCR text can go further and quote a real order number or tracking code from your old screenshots. We covered this playbook after the Brevo hack that sent fake Trezor alerts: stolen context makes a lure feel legitimate.

What Should Gyazo Users Do Now?

Change your Gyazo password first, then every password you reused, then lock down the email account that receives Gyazo's codes. In order:

Reset your Gyazo password by typing gyazo.com into your browser yourself, not through a link in an email.
Reset reused passwords, starting with your email account. Treat any password close to your Gyazo one as burned, since the hash algorithm is unknown.
Turn on app based 2FA for Gmail so a stolen password alone cannot reach the codes Gyazo sends there.
Check your exposure. Have I Been Pwned had no Gyazo entry when we queried its breach API on 18 September 2026. Subscribe to its notifications so you hear if the data surfaces.
Audit old captures. Delete screenshots from 2019 and earlier that show addresses, codes, receipts, or other people's emails. Revoke the X connection in your account settings if you ever linked it.
Distrust Gyazo themed email. Check the sender domain and never enter credentials from a link. Real notices come to your registered address and should not ask for your password.

Looking Ahead

Watch for three things: whether Helpfeel names the hashing algorithm, whether the dataset appears for sale, and whether the Personal Information Protection Commission acts. Japanese companies have disclosed several large incidents this year, including the Sakura Internet hack that exposed 1.36 million accounts. Gyazo's is roughly 17 times larger by record count. Until the investigation ends, assume your screenshots from before 2019 were read, and change the passwords that matter.