The Gyazo image-sharing platform has confirmed it suffered a data breach after hackers exploited a server vulnerability that allowed them to steal 23.6 million user records.
Gyazo is a cloud-based screenshot and screen-recording tool operated by Helpfeel that automatically uploads user screen captures to the cloud and gives them a shareable link to share on chats, forums, social media, etc.
It’s especially popular in gaming communities and claims 23 million users worldwide, who have submitted 3.1 billion media items.
According to an announcement by the company, the incident occurred on September 11, 2026, allowing attackers to access its database and obtain approximately 23.62 million user records.
The company has now taken the platform offline while it conducts maintenance.
“Currently, the Gyazo service is temporarily suspended for maintenance as a preventive measure. We sincerely apologize for any inconvenience caused. Please wait a little longer until recovery,” reads a post on X.
The company detected the suspicious activity on September 12 and fixed a vulnerability the attackers used to breach the platform, but by then, the data had already been stolen.
“Our subsequent investigation confirmed that the third party had accessed Gyazo’s database and that user information and metadata associated with uploaded images had been disclosed without authorization,” confirmed Gyazo in a statement published earlier this week.
Based on Gyazo’s investigation, the data that has been exposed varies per user and may include one or more of the following:
The exposed dataset includes anonymous account records, though Gyazo did not share what percentage those represent.
The platform also stated that the incident exposed 490 million image metadata records, most associated with images uploaded to the service before January 2019.
These metadata include image IDs used to construct image URLs, upload IP addresses, User-Agent strings, EXIF location data, OCR-extracted text, image titles, source URLs, and hashed passphrases for private images.
Helpfeel notes that image IDs can potentially be used to access the corresponding content, which is why the company has temporarily disabled access to files whose records were exposed.
Additionally, it stated that the hackers also obtained a list identifying private images, and the company cannot rule out that some were viewed.
The firm said its investigation has not found signs of data being deleted due to this incident.
The company also found no evidence that its other Helpfeel and Cosense services had data stolen.
The firm is notifying affected users directly as they conduct an investigation with external experts, and have contacted the authorities.
All Gyazo users are advised to change their passwords on the service and other platforms where they use the same credentials, and remain alert for suspicious communications.
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
Sakura Internet hack exposes data of up to 1.36 million accounts
CenterPoint Energy confirms customer data stolen in cyberattack
Dropbox accounts breached through Lenovo email verification flaw
Manchester Airports Group says hackers stole travelers’ data
LACMA data breach last year exposed social security and medical data
Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer
ShinyHunters hacks Clop leak site, threatens to extort ransomware gang
Microsoft fixes bug behind ‘Defender Antivirus is turned off’ alerts
Patch automation needs more than speed. Action1 brings control into every stage of deployment.
Watch a working exploit hit live controls and see exactly what blocks, detects, or misses
Automate Onboarding and Access Reviews with No-Code IGA: See how it works
Overdue a password health-check? Audit your Active Directory for free
Find out how long recovery really takes — and what it costs. Read the 2025 BCDR Report.
Terms of Use – Privacy Policy – Ethics Statement – Affiliate Disclosure
Read our posting guidelinese to learn what content is prohibited.
