Short answer
Helpfeel, the developer of Gyazo, said a third party exploited a vulnerability in the service's image upload server on 11 September 2026 and ran arbitrary commands. The company says about 23.62 million user records and about 490 million image metadata records were affected.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Gyazo (Helpfeel) |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Image and screenshot sharing |
| Country | Japan |
| Detected | 2026-09-11 |
| Disclosed | 2026-09-16 |
| People or records affected | About 23.62 million user records and about 490 million image-related metadata records |
What data was exposed
- User records: names or nicknames, email addresses, password hashes, user and device IDs, login session IDs, X integration tokens, Google sign-in email addresses, profile data, subscription plans and usage statistics
- Image metadata: image IDs, upload IP addresses, user agents, EXIF location data, OCR text, titles, source URLs and hashed passphrases for private images
- A list identifying private images; Helpfeel cannot rule out that some were viewed
- Payment card numbers were not listed among the exposed data
What happened
Gyazo is a screenshot and image-sharing tool run by Japanese company Helpfeel. In a notice first published on 16 September 2026 and updated since, Helpfeel says a third party exploited a vulnerability in the Gyazo image upload server on 11 September and executed arbitrary commands. Suspicious activity was detected that evening. On 12 September access routes were blocked and unauthorized connections ended. On 14 September Helpfeel confirmed unauthorized disclosure of information and suspended image delivery as a precaution.
Delivery resumed for newly uploaded images on 15 September, the same day Helpfeel reported the incident to Japan’s Personal Information Protection Commission. Gyazo was suspended again for security maintenance from 24 to 27 September. The notice lists a further update from 21 October with investigation results that we could not read in full.
What was exposed
Helpfeel puts the user data affected at about 23.62 million records. These include names or nicknames, email addresses, password hashes, user and device IDs, login session IDs, X integration tokens, Google sign-in email addresses, profile data, subscription plans, billing status and usage statistics. Anonymous accounts are counted, so the number of actual people is still being determined. Payment card numbers are not listed among the data.
A second set covers about 490 million image-related metadata records: image IDs, upload IP addresses, user agents, EXIF location data, OCR text, titles, source URLs and hashed passphrases for private images. Helpfeel says that data includes information used to build Gyazo image URLs, which could let a third party view images without authorization. It says it cannot rule out that some private images were viewed, though it has not confirmed loss of image data.
Why the metadata worries experts
Infosecurity Magazine, which reported the scale on 21 September, quoted researchers on the risk. Michael Bell of Suzu Labs noted that screenshots can contain terminal output, API keys and credentials, and that OCR makes that text searchable. Seemant Sehgal of BreachLock pointed to location history from EXIF data. Damian Skeeles of Filigran said most of the data relates to images from 2019 or earlier, which lowers the value of any leaked secrets, but still urged regular credential rotation.
Helpfeel’s response
The company patched the exploited vulnerability, invalidated and restricted authentication data, disabled viewing of some images and started an external forensic investigation. It plans to notify affected users by email or through the Gyazo web interface, and to strengthen authentication, access controls and monitoring.
What to do
Change your Gyazo password and any reused one. Go through old screenshots for credentials you should rotate. Be wary of messages that mention Gyazo, since the exposed email addresses make convincing phishing easy. Real notices will come by email or inside the Gyazo interface, so never act on a link in a message you did not expect.
See our data breach checklist, our guide to phishing messages, and the Japanese data breaches we are tracking.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Phishing emails posing as Gyazo or Helpfeel that ask you to reset a password or 'verify' an account through a link.
- Extortion emails that quote your EXIF location, source URLs or screenshot text to claim the sender has your private images.
- Attempts to log in to other services with your reused Gyazo password, or to use API keys and tokens that appeared in old screenshots.
What to do if you are affected
- 01Change your Gyazo password, and change it on any other site where you used the same one.
- 02Use a password manager so every account has a unique password, and turn on multi-factor authentication where available.
- 03Review old screenshots for passwords, API keys and tokens, and rotate any that you find. Delete screenshots you no longer need.
- 04Reconnect or revoke any X (Twitter) or Google sign-in link to Gyazo you do not use.
- 05Treat unexpected emails that mention Gyazo as suspicious, and use the official contact forms at help.gyazo.com/contact-us.
Frequently asked questions
What happened to Gyazo?
Helpfeel says a third party exploited a vulnerability in Gyazo's image upload server on 11 September 2026 and executed arbitrary commands. Suspicious activity was detected that evening, access routes were blocked on 12 September, and the flaw was remediated.
Were my images stolen?
Helpfeel has not confirmed loss of image data. It says the attacker obtained a list identifying private images and that it cannot rule out that some were viewed. It disabled viewing of some images and suspended image delivery as a precaution.
Were passwords exposed?
Password hashes were among the user data affected, not plain-text passwords. Helpfeel still urges users to change their Gyazo password and any reused password elsewhere.
Is the metadata recent?
Helpfeel says most of the metadata covers images registered on or before January 2019, about 14.4% of image-related data. Metadata for about 2.4 million further images was retrieved using specific filters.
Sources
- Notice on unauthorized access to Gyazo (with updates), Helpfeel, 2026-09-16
- Experts Alarmed Over Gyazo's Breach of 490 Million Metadata Records, Infosecurity Magazine, 2026-09-21
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.