Gyazo Data Breach: 23.62 Million User Records Exposed — What to Do Now

Helpfeel, the Kyoto-based company behind the screenshot-sharing tool Gyazo, has confirmed that an attacker broke into its systems on September 11, 2026, walking away with tens of millions of user records and hundreds of millions of image metadata entries.

What happened

On September 11, 2026, an unidentified third party exploited a vulnerability in Gyazo's image upload server, gaining unauthorized access to Helpfeel's systems and running arbitrary commands on them [1]. Helpfeel detected suspicious activity that same evening and, by the early hours of September 12, had blocked the access routes the attacker used and cut off the unauthorized connections [1].

It wasn't until September 14 that Helpfeel's investigation confirmed data had actually left the building — that user information and image metadata tied to Gyazo had been disclosed without authorization [1]. The company reported the incident to Japan's Personal Information Protection Commission on September 15 and published its public notice on September 16 [1]. In the interim, Gyazo's own product-updates channel had described the resulting service disruption only as "emergency maintenance," without mentioning a breach [5].

How big is this, really?

Helpfeel says approximately 23.62 million records tied to Gyazo users were exposed [1]. That number is a record count, not a headcount — the dataset includes anonymous accounts with no registered email address, so Helpfeel says it's still working out how many actual people were affected [1][2]. Separately, roughly 490 million image metadata records were exposed, most of them tied to images registered in or before January 2019 — about 14.4% of all image-related data on the platform — plus another 2.4 million images' metadata retrieved through specific filtering [1].

Why the image metadata matters

This part is the sharper edge of the story. Every Gyazo capture gets a link built from a long, effectively random image ID — Gyazo's own help documentation calls these links "unguessable," and treats possession of the link as the access control for a private image [5]. The leaked metadata includes exactly the IDs used to build those links. Helpfeel acknowledged that this information "could be used by a third party to access and view the corresponding images without authorization," and confirmed the attacker also obtained a list identifying which images were private [1]. The company says it hasn't ruled out that private images were actually viewed, and it temporarily disabled viewing of some images while it investigates [1]. Helpfeel has, so far, found no evidence that image files themselves — as opposed to metadata — were taken [1].

Timeline

What's still unknown

Helpfeel hasn't said what kind of vulnerability was exploited, and no CVE identifier has been published for it, so this piece doesn't speculate about the technical mechanism [5]. The company also hasn't confirmed exactly how many individual people (as opposed to records) were affected, hasn't said whether any private images were actually viewed rather than just made accessible, and hasn't attributed the intrusion to any named actor or group [1]. Treat any claim beyond what's stated here — including firm attribution or a confirmed image-viewing count — with skepticism until Helpfeel's forensic investigation, which it says is being run with outside specialists, produces more detail [1].

What Gyazo users should do now

• Change your Gyazo password immediately — Helpfeel is asking all users to do this, regardless of whether they've received an individual notification [1].
• Change that password anywhere else you reused it. Exposed password hashes plus emails is a classic credential-stuffing setup [1].
• Be cautious with unsolicited messages referencing Gyazo, Helpfeel, or this breach — Helpfeel specifically warned users to watch for suspicious emails or messages tied to the incident [1].
• Think about what you've shared via Gyazo links. Because the exposed metadata includes the IDs that make image links work, treat any sensitive screenshots you've shared through Gyazo as having reduced confidentiality, even if the link was never posted publicly [1][5].
• Watch for a notification email or in-app notice. Helpfeel says it will contact affected users with registered emails directly and will use the Gyazo web interface to reach anonymous accounts [1].

The bigger picture

Helpfeel also operates its namesake knowledge-base product and a note-taking tool called Cosense; the company says those run on different architecture and it has found no evidence they were affected [1]. Some images embedded in those products via Gyazo may be temporarily unavailable because of the image-delivery suspension [1]. Helpfeel says it's reviewing authentication, authorization, and access controls, and looking at its other services for similar issues [1].

Security takeaway

This wasn't a sophisticated supply-chain compromise or a nation-state operation — it was a flaw in a file-upload server that let an outsider run commands and reach a database. That's a familiar pattern, and it's worth remembering that a service built around "unguessable" links is only as private as the system storing those links. If you have a Gyazo account, the move right now isn't to panic — it's to change your password, check for reused credentials elsewhere, and stay alert for follow-on phishing that name-drops this breach.

Sources & References

1. Helpfeel Inc. — "Notice and Apology Regarding a Data Breach Resulting from Unauthorized Access to Gyazo," September 16, 2026 (official notice)
2. SecurityWeek — "23 Million User Records Compromised in Gyazo Data Breach"
3. TechRadar Pro — "Gyazo breach exposes 23.62 million user records and 490 million image records"
4. Cybernews — "Gyazo data breach leaves over 23 million user records exposed"
5. The Hacker News — "Gyazo Breach Exposes 23.62 Million User Records"
6. Security Affairs — "23 Million User Records Compromised in Gyazo Data Breach"