Gyazo Breach: Data on 23.6 Million Users Stolen

The Gyazo platform has disclosed a data breach: attackers exploited a server vulnerability to gain access to its database, making off with roughly 23.62 million user records. Gyazo is a cloud-based tool for capturing screenshots and recording your screen, developed by the company Helpfeel; captures are automatically uploaded to the cloud and assigned a link for quick sharing in chats, on forums, and across social media. The service is especially popular in gaming communities and claims 23 million users who have uploaded 3.1 billion media files.

Timeline of the incident

According to the company, the incident occurred on September 11, 2026. The suspicious activity was only spotted the following day, September 12, after which the vulnerability was patched — but by then the data had already been stolen. The platform was temporarily taken offline while the investigation and technical work were carried out. In a post on X, the company apologized for the inconvenience and asked users to wait for the service to be restored.

What the attackers got hold of

The makeup of the stolen data varies from user to user and may include names and nicknames, email addresses, password hashes, user and device identifiers, session identifiers, X integration tokens, Google SSO addresses, profile details, subscription and billing data, as well as usage statistics. Anonymous accounts were also caught up in the dump, though the company did not disclose what share they made up.

A particular cause for concern is the 490 million image metadata records — mostly for files uploaded before January 2019. These include the image identifiers used to build URLs, upload IP addresses, User-Agent strings, EXIF geolocation data, OCR-recognized text, titles, source links, and hashed passphrases for private images. The company stresses that the identifiers could potentially be used to reach the content itself, which is why access to the affected files has been temporarily disabled. What's more, the attackers obtained a list flagging private images, and Helpfeel cannot rule out that some of them may have been viewed.

Fallout

The investigation found no signs that data was deleted; nor did it turn up any evidence of theft from Helpfeel's other services — Cosense and the eponymous product. The company is notifying those affected directly, has brought in outside experts, and has contacted law enforcement. All users are advised to change their Gyazo password, as well as passwords on any other sites where the same credentials were used, and to stay alert to suspicious messages.

Source: Bleeping Computer