An attacker who reached Gyazo’s image upload server on September 11, 2026, ran commands on the screenshot service’s systems and left with more than 23 million user records. Helpfeel, the Japanese company behind Gyazo, puts the figure at 23.62 million records, plus roughly 490 million rows of image metadata.
The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
Gyazo exists to make sharing a screen capture as easy as pasting a link, which is why the stolen data matters. The same database that ties an account to an email address also ties it to devices, login sessions and the identifiers used to build image addresses. Helpfeel says payment card data was not taken, but a long list of other personal details was.
The upload server flaw and the first 24 hours
According to SecurityWeek’s report on the breach, the attacker exploited a vulnerability in the image upload server and then gained unauthorized access to a database storing the user records. Helpfeel has not described the flaw itself, so how an upload feature turned into command execution remains unexplained.
Helpfeel’s own timeline, published in its September 16 notice, shows a quick but not instant response. A third party exploited the flaw on September 11 and ran commands on the systems. Helpfeel blocked the access routes and closed the unauthorized connections on September 12, then confirmed on September 14 that data had actually been disclosed and suspended image delivery as a precaution. A report went to Japan’s Personal Information Protection Commission on September 15.
What 23.62 million records and 490 million image rows contain
The user records include names or nicknames, email addresses, password hashes, user and device IDs, and login session IDs. Where users had connected them, X integration tokens and Google single sign-on email addresses were also in the database, along with profile details, language settings, registration and last-login times, subscription plan, billing status and usage statistics. Helpfeel says no credit card or other payment method data was disclosed.
The count carries a caveat. Helpfeel said the 23.62 million figure includes anonymous accounts with no registered email address, and it is still working out how many distinct people are affected. In its words, the company is “continuing to determine the actual number of individuals” whose data was disclosed, so the real number of people could be lower than the record count.
The second set is larger and stranger. About 490 million image metadata records were exposed, mostly tied to images registered in or before January 2019, which Helpfeel puts at about 14.4 percent of image-related data. Those rows include image IDs, the IP addresses images were uploaded from, browser User-Agent strings, EXIF location data where a photo carried it, text pulled from images by optical character recognition, titles and source URLs.
Private images and the questions Helpfeel has not closed
Image IDs are the piece that worries analysts most, because they are what Gyazo uses to build the web address of each picture. Help Net Security’s coverage notes that the exposed identifiers could let third parties view images without permission, and Helpfeel has disabled viewing of some images in response without saying which ones.
The attacker also obtained a list identifying private images, plus metadata for about 2.4 million images pulled using specific filters, including hashed passphrases that protect private images. Helpfeel said it could not rule out that some private images were viewed, and it has not confirmed any loss of image data itself. The Hacker News reported that Gyazo’s early public notices described the outages as maintenance without mentioning the breach, a gap that left users guessing for days. Helpfeel’s other products, Helpfeel and Cosense, use different architectures, and the company says no unauthorized disclosure from them has been confirmed. Images from Gyazo that are embedded in those services may be unavailable while delivery is affected.
Password steps and what comes next
Helpfeel asks every Gyazo user to change their Gyazo password and to change it on any other service where the same or a similar password was used. Because password hashes were taken, reuse is the practical risk: an attacker who cracks a weak hash can try the same combination elsewhere. Users should also treat unexpected emails that mention Gyazo or the incident with suspicion, since names and addresses are now in criminal hands. Questions go to Helpfeel through the English-language Gyazo contact form that the notice points to,, while anonymous accounts with no email address are to be told through the Gyazo web interface.
Helpfeel plans to email affected users and, for anonymous accounts without a usable address, to post notices inside the Gyazo web interface. It says an external forensic investigation is continuing, that it will report to data protection authorities in Japan and elsewhere, and that it will tighten authentication, access controls, monitoring and secure development practices. Its notice later added updates dated September 24 and 27 describing maintenance and the service resuming, so the final tally may still move.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
The day in tech, in one email: Get TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- NOAA now gives this winter a 75% chance of the strongest El Nino since 1950
- Doctors warn a silent liver disease now affects one in three American adults
- The FBI told the rest of ShinyHunters to surrender after a 24-year-old was arrested
- Two passengers died at an Ohio toll plaza, and the NTSB now wants the cash lanes shut
