The image-sharing and screen-recording platform Gyazo confirmed that it was hacked on September 11, 2026, after attackers exploited a vulnerability in one of its servers to access the database and steal approximately 23.62 million user records. The company, operated by Helpfeel, announced that it had temporarily suspended the service for maintenance and investigation.
Gyazo detected the suspicious activity on September 12 and said it had fixed the vulnerability used in the attack, but the data had already been copied. According to the company’s statement, the unauthorized access included user information and metadata associated with uploaded images.
What data was accessed?
The scope of the exposed data varies from account to account and may include usernames or nicknames, email addresses, password hashes, user and device IDs, login session IDs, X integration tokens, email addresses associated with Google login, as well as profile details, subscription information, billing status, and usage statistics.
The data also included anonymous accounts, although Gyazo did not specify their proportion of the total records.
490 Million Image Metadata Records
The company said the incident also affected approximately 490 million image metadata records, most of which were associated with images uploaded before January 2019. This data includes image IDs used to construct their URLs, IP addresses at the time of upload, User-Agent strings, location data extracted from EXIF, text extracted using OCR, image titles, source URLs, and hashed passphrases for private images.
Helpfeel acknowledges that image IDs may be used to access the corresponding content, and therefore temporarily disabled access to the files covered by the exposed records. The attackers also obtained a list identifying private images, and the company cannot rule out the possibility that some of them were viewed, although it found no indications that data was deleted as a result of the incident.
Why does this matter?
The risk here is not limited to account data; image metadata may reveal upload locations or text extracted from images, while image IDs and URLs may help link records to content. The presence of session IDs and integration tokens among the potentially exposed data further increases the importance of response measures, even though the company has not announced evidence that those elements were used.
Helpfeel found no evidence that data was stolen from its other two services, Helpfeel and Cosense, and said it was notifying affected users directly and investigating the incident with the assistance of external experts, while also reporting it to the authorities.
Gyazo advises all users to change their passwords on the service and on any other platforms where the same passwords were used, in addition to being cautious of suspicious messages. The proportion of anonymous records and whether private images were actually viewed remain unresolved points that the source has not yet settled.