Gyazo Breach Exposes 23.62 Million User Records 

Helpfeel, the Kyoto-based operator of the Gyazo screenshot and screen-recording service, confirmed that an attacker exploited a vulnerability in Gyazo’s image upload server on September 11, 2026 and reached the service’s database.

The breach exposed approximately 23.62 million user records, metadata for approximately 490 million images, and metadata tied to approximately 174 million images users had already deleted.

The 23.62 million figure counts records, and the number of affected individuals remains unconfirmed. Approximately 18.01 million records belong to anonymous accounts with no registered email address, while approximately 5.62 million belong to users with a registered email. Credit card numbers and other payment method details were not exposed.

Gyazo suspended service during the response and resumed operations on September 27, 2026. This article covers the attack, the exposed data, Helpfeel’s response, user risks, and the questions still open as of October 7, 2026.

Gyazo Breach Status As Of October 7, 2026

What Happened In The Breach

On September 11, 2026, an attacker exploited a vulnerability in Gyazo’s image upload server, gained the ability to execute arbitrary commands on Helpfeel’s systems, and accessed the Gyazo database.

Helpfeel spotted suspicious activity that evening, Japan time, and by the early hours of September 12 had blocked the access routes, cut the attacker’s connections, and fixed the flaw.

The short window was enough. Follow-up analysis on September 14 confirmed that user records and image metadata had left the database, and Helpfeel suspended image delivery that day to stop anyone from using the stolen data to open images.

That suspension mattered because of how Gyazo links work. Every capture gets a URL built from a 32-character image ID, and for captures left at the default “Anyone with the link” setting, that URL is the only thing standing between the image and the public.

The stolen metadata contains those IDs, plus a list that marks which images were private.

Timeline From Exploitation To Service Restoration

Fourteen days separated the start of the attack from Helpfeel’s fullest account of the damage, and the deleted-image exposure only surfaced in the second update.

What Data Was Exposed

The breach hit two separate data sets: account records and image metadata. Contents varied by user, and anonymous accounts carried far less personal data than registered ones.

The user records included:

• Names or nicknames, email addresses, and password hashes
• User IDs, device IDs, and login session IDs
• X (formerly Twitter) integration tokens and Google SSO email addresses for connected accounts
• Profile details, language preferences, registration and last-login timestamps
• Subscription plan, billing status, and usage statistics

The image metadata included:

• Image IDs used to build Gyazo image URLs
• Upload IP addresses and user-agent strings
• EXIF location data where the image carried it
• OCR text extracted from screenshots, image titles, and source URLs
• Hashed passphrases for password-protected private images

OCR text is the sleeper risk here. Screenshots routinely capture dashboards, internal chats, and credentials, and for accounts with Gyazo’s paid OCR feature turned on, the text inside those images sat in the database as searchable data.

The 174 million deleted-image records add a retention problem: the image files are gone and inaccessible, but their metadata, including any extracted text, survived deletion and was taken.

Who Was Responsible And How Access Occurred

No group has claimed the attack, and Helpfeel has not named a threat actor. The company has not disclosed the vulnerability class either, so any claim about a specific CVE, file-upload bypass, or exploit chain goes beyond the public record.

The confirmed attack path is short: a flaw in an internet-facing upload server led to command execution, and command execution led straight to the production database.

Helpfeel’s own remediation plan points at the same gap, listing reviews of authentication, authorization, and access controls alongside stronger monitoring and audit processes.

External forensic specialists are still investigating, and Helpfeel is querying its cloud infrastructure providers about the root cause. Helpfeel’s two other products, the Helpfeel support platform and Cosense, run on separate architecture and show no sign of compromise.

Impact And Risks For Affected Users

Password reuse is the most immediate threat. Helpfeel has not named its hashing algorithm, so the 5.62 million registered accounts face cracking attempts, and any recovered password becomes fuel for credential stuffing against email, cloud storage, and work accounts.

Stolen email addresses paired with knowledge of the breach make Gyazo-themed phishing easy to write and convincing to read.

Companies carry a separate exposure. Employees use Gyazo to share screenshots of dashboards, tickets, configuration pages, and chat threads, and the OCR text pulled from those images now sits outside Helpfeel’s control.

A single screenshot of an admin console or an API key can outlive the password reset that follows the breach.

Helpfeel cannot rule out that the attacker viewed some private images. EXIF location data adds a physical-safety dimension for anyone who uploaded phone photos with GPS tags intact.

The session IDs and X integration tokens carry less risk, since Helpfeel invalidated the affected authentication data and confirmed the X tokens alone cannot log in to or operate X accounts.

Gyazo’s Response

Helpfeel blocked the attack routes, fixed the vulnerability, and invalidated the exposed authentication data, including OAuth integration tokens. It disabled viewing for affected images, then took the whole service offline on September 24 for security verification before bringing it back on September 27.

The restoration came with a deliberate restriction. Every image uploaded before the attack now opens only for its owner, and users must review each image and select “Resume delivery” to restore its earlier visibility.

Free plan users, normally limited to recent captures, temporarily get access to their full history so they can make that call.

Japan’s Personal Information Protection Commission received Helpfeel’s preliminary report on September 15. The company has briefed the Ministry of Internal Affairs and Communications, and is reporting to overseas data protection authorities under laws including the GDPR.

Registered users are receiving email notifications on a rolling basis, and anonymous users get notices inside the Gyazo interface.

Future commitments include a security risk assessment across the entire service, an external expert advisory structure, expanded developer security training, and a review of its other products for similar vulnerabilities.

Steps Affected Users Can Take

Gyazo users and the companies whose staff relied on it can work through these steps now that the service is back online:

1. Change your Gyazo password. Do the same on every other account that used the same or a similar password.
2. Turn on multi-factor authentication. Prioritize email, cloud storage, and work accounts that shared the Gyazo password.
3. Review images before resuming delivery. Delete captures you no longer need and keep sensitive ones on “Only me.”
4. Rotate secrets that appeared in screenshots. API keys, passwords, tokens, and internal URLs captured in any Gyazo image deserve a reset, deleted images included.
5. Audit connected accounts. Check the Google and X accounts linked to Gyazo for unfamiliar sessions or app authorizations.
6. Watch for Gyazo-themed phishing. Treat any message about the breach that asks for credentials or payment as suspect, and contact Gyazo through its official support form.

What Remains Unclear

The forensic investigation is still open, and Helpfeel’s notices leave these questions unanswered:

• The vulnerability class and whether it carries a public CVE
• The password hashing algorithm, which decides how fast stolen hashes can be cracked
• The real number of affected individuals behind the 23.62 million records
• Whether the attacker opened any private images
• Why metadata for images deleted as far back as early 2023 still sat in a production database
• How many affected users live outside Japan and which foreign regulators are involved

Helpfeel had confirmed no secondary misuse of the stolen data as of its September 25 update.

Why This Incident Matters

Gyazo’s breach is a SaaS architecture lesson in three parts. A public file-upload endpoint, one of the most attacked surfaces on any web application, gave the attacker command execution.

That server could reach the production database, so a single flaw exposed the entire user table. And deleted content left metadata behind, which turned years of old screenshots into fresh exposure.

Each of those failures shows up in enterprise security reviews. Buyers now ask SaaS vendors how upload handling is tested, how production data is segmented, and what happens to customer data after deletion. Gyazo’s notices answer all three the hard way, in public, after the fact.

For companies on the customer side, the incident is a reminder that a screenshot tool can hold more sensitive business data than the systems it captures, and that tools adopted by individual employees rarely pass through vendor risk review.

How Bright Defense Can Help Reduce Similar Breach Risks

Gyazo’s breach maps to three areas of the SOC 2 Trust Services Criteria: vulnerability management (CC7.1), logical access and segmentation (CC6.1), and disposal of confidential information (C1.2).

Bright Defense runs SOC 2 readiness and audit preparation for SaaS companies, and that work tests the exact failures that let one upload-server flaw reach an entire user database.

Every engagement starts with a gap assessment against the SOC 2 controls list, then moves to the fixes that matter for SOC 2 for SaaS companies: retention schedules that purge metadata and derived data such as OCR text when a customer deletes content, segmentation that keeps upload and processing services from querying production user tables, and patch timelines tied to severity.

Auditors commonly look for independent testing evidence, and Bright Defense SOC 2 penetration testing goes after the surfaces Gyazo lost: file-upload handlers, image processing pipelines, and the internal paths from those services to customer data.

Each finding feeds the remediation evidence an auditor reviews under CC7.1.

The finished SOC 2 Type II report gives enterprise buyers documented answers on upload testing, data segmentation, and deletion, the three areas this breach exposed.

Book a SOC 2 readiness call with Bright Defense to test your upload paths, segmentation, and deletion controls before an attacker does.

References

Helpfeel Inc. (2026, September 16). Notice and apology regarding a data breach resulting from unauthorized access to Gyazo. https://corp.helpfeel.com/en/news/news-20260916

Helpfeel Inc. (2026, September 25). Notice and apology regarding a data breach resulting from unauthorized access to Gyazo (Update 2). https://corp.helpfeel.com/en/news/news-20260925

Helpfeel Inc. (2026, September 26). Notice regarding the resumption of Gyazo services. https://corp.helpfeel.com/en/news/news-20260927-02

Khandelwal, S. (2026, September 17). Gyazo breach exposes 23.62 million user records and 490 million image metadata records. The Hacker News. https://thehackernews.com/2026/09/gyazo-breach-exposes-2362-million-user.html