Screenshot Service Gyazo Confirms Breach Exposing 23.6 Million User Records
Gyazo, a cloud-based screenshot and screen-recording service operated by the Japanese company Helpfeel and popular in gaming communities, confirmed it suffered a data breach after attackers exploited a server-side vulnerability to access its database. The company says roughly 23.62 million user records were exposed in the intrusion, which it traced to September 11, 2026, along with 490 million records of metadata tied to images uploaded before 2019. Gyazo claims about 23 million users worldwide who have collectively uploaded more than 3.1 billion images, making this one of the larger platform breaches disclosed this year.
According to Gyazo’s public disclosure, the exposed user data varies by account but may include names or nicknames, email addresses, hashed passwords, device and login session identifiers, tokens tied to X (formerly Twitter) integration, Google single sign-on email addresses, subscription and billing details, and usage statistics. The separately exposed image-metadata records include upload IP addresses, browser user-agent strings, embedded EXIF location data, OCR-extracted text pulled from images, source URLs, and hashed passphrases protecting private images. The company said attackers also obtained a list identifying which images were marked private, and it could not rule out that some of those images had been viewed, though it found no evidence that any data was deleted.
Gyazo detected the suspicious activity on September 12, a day after the intrusion began, patched the vulnerability attackers had used, and took the platform offline for what it described as preventive maintenance while it worked with external investigators and notified law enforcement. The company said it found no indication that data belonging to its other products, Helpfeel and Cosense, was affected. It is directly notifying impacted users and has advised all account holders to change their Gyazo password and any other accounts where they reused the same credentials, given the scale of credential and session data potentially exposed.