The Gyazo data breach 2026 has now been confirmed by Helpfeel, the company behind the cloud-based screenshot and screen-recording platform, after attackers exploited a server vulnerability and walked off with approximately 23.62 million user records. The platform, which claims 23 million users worldwide and hosts 3.1 billion media items, has been taken offline while Helpfeel carries out what it describes as emergency maintenance.
The intrusion occurred on 11 September 2026. Gyazo detected the suspicious activity the following day and patched the vulnerability the attackers had used, but the data had already gone. ‘Our subsequent investigation confirmed that the third party had accessed Gyazo’s database and that user information and metadata associated with uploaded images had been disclosed without authorisation,’ the company said in a statement published earlier this week.
What was taken in the Gyazo data breach
The exposed records vary per user. Depending on account type and history, affected information may include names and nicknames, email addresses, password hashes, user and device IDs, login session IDs, X integration tokens, Google SSO email addresses, profile details, subscription information, billing status, and usage statistics. The dataset also includes anonymous account records, though Helpfeel has not said what proportion of the 23.62 million those represent.
Beyond user account data, the breach exposed 490 million image metadata records, the majority tied to images uploaded before January 2019. That metadata covers image IDs (which can be used to construct direct URLs to content), upload IP addresses, User-Agent strings, EXIF location data, OCR-extracted text, image titles, source URLs, and hashed passphrases for private images. Because image IDs can be used to reach the underlying files, Helpfeel has temporarily disabled access to any content whose records were involved.
The company also confirmed that attackers obtained a list identifying private images, and cannot rule out that some of those were viewed. No evidence has emerged of data being deleted as a result of the incident. Helpfeel’s other products, Cosense and the Helpfeel service itself, appear unaffected.
One thing not on the list: payment card data. According to Tech Insider, Helpfeel has confirmed that no payment card information was exposed in the breach, which will offer some relief to paying subscribers.
Gyazo data breach response and regulatory notification
Helpfeel has been working with external security experts and has notified law enforcement. In a move required under Japanese data protection rules, the company reported the incident to Japan’s Personal Information Protection Commission on 15 September, four days after the breach occurred, according to The Hacker News. The story was subsequently picked up more broadly when OptMsg noted that wider coverage followed on 18 September.
Gyazo is particularly well used in gaming communities, where quick screenshot sharing and forum embeds are part of the daily workflow. That community skew matters here: session IDs and X integration tokens in the wrong hands could, in principle, be used for account takeover attempts on linked platforms, not just on Gyazo itself.
While the platform remains suspended, Helpfeel is notifying affected users directly. The company’s current message on X reads: ‘Currently, the Gyazo service is temporarily suspended for maintenance as a preventive measure. We sincerely apologize for any inconvenience caused. Please wait a little longer until recovery.’
For all Gyazo users, the practical advice is standard but worth following: change your Gyazo password immediately, and if you have reused that password elsewhere, change it on every other service too. Given the presence of X tokens and Google SSO data in the exposed records, it is worth auditing connected app permissions on both platforms. Helpfeel has also urged users to stay alert for phishing attempts and suspicious communications that could exploit the personal details now potentially in circulation.
Helpfeel says its investigation is continuing, with external experts still engaged. The company has committed to keeping users updated as that work progresses.
