Gyazo Breach: 23.6M User Records After Upload Hack

Thu Sep 17

Helpfeel Inc. just confirmed one of the larger consumer breaches of 2026: roughly 23.62 million Gyazo user-related records and about 490 million image metadata records left the company's systems after a third party exploited the image upload server. The Kyoto-based firm published a detailed English notice on September 16, five days after the intrusion began.

Gyazo is the screenshot and GIF sharing tool that developers, support teams, and casual users have pasted into chat for years. The Gyazo data breach did not need a phishing lure or a ransomware note. An attacker got remote command execution on the upload path, reached the database, and walked away with account fields plus metadata that can reconstruct image URLs.

This piece walks through Helpfeel's timeline, what was exposed versus what was not, why image metadata matters as much as emails and password hashes, who should assume risk, and the concrete steps Gyazo users should take. Canonical record: Gyazo Helpfeel 2026 breach on BreachHistory.

What happened on September 11

According to Helpfeel's official notice, a third party exploited a vulnerability in Gyazo's image upload server on September 11, 2026 (Japan Standard Time). That foothold let the attacker execute arbitrary commands on the affected systems.

Helpfeel detected suspicious activity the same evening and started incident response. By the early hours of September 12, the company had blocked the identified access routes and terminated the unauthorized connections. The vulnerability used in the Gyazo breach was remediated during that initial response window.

Confirmation that the attacker had actually pulled data took longer. Helpfeel says its investigation established unauthorized disclosure of Gyazo information on September 14. That same day, the company suspended image delivery as a precaution while it mapped scope. On September 15 it notified Japan's Personal Information Protection Commission (PIPP Commission), resumed delivery for images newly uploaded after the access controls were fixed, and continued forensic work with external specialists. The public apology and inventory landed on September 16.

Trade press including The Hacker News and TechRadar Pro summarized the same counts Helpfeel published. No public CVE identifier appears in Helpfeel's notice; the company described the root cause as a vulnerability in the upload server without naming a patch ID.

How the attack worked

Helpfeel's write-up is unusually clear about the access path. The attacker did not need to phish a helpdesk password or buy a leaked Gyazo session cookie first. They hit a flaw in the image upload server — the component that receives screenshots, GIFs, and videos — and used it to run arbitrary commands.

From there, the intruder reached Gyazo's database. Helpfeel states that user information and metadata associated with uploaded images were disclosed without authorization. The company has not published a packet capture or malware family for this Gyazo hack 2026 case, and it has not claimed the attacker left a persistence implant beyond the window they blocked.

That upload-to-RCE pattern matters for other media platforms. Upload endpoints often sit behind less scrutiny than login APIs because they are expected to accept large binary payloads, transform images, and write to object storage. When that path can be turned into shell, the database is usually a short lateral move away.

Helpfeel says it reviewed authentication-related fields for misuse potential and already invalidated and restricted the relevant tokens and sessions. Image delivery for some content remained suspended while investigators assessed whether private URLs could be reconstructed from stolen metadata.

What data was exposed

User-related records — about 23.62 million

Helpfeel confirmed approximately 23.62 million records containing data related to Gyazo users. The Gyazo breach inventory includes anonymous accounts that never registered an email, so the unique-person count is still open. Fields confirmed in the company notice include:

Name or nickname (whatever text the user entered)
Email address
Password hash
User ID, device ID, and login session ID
X (formerly Twitter) integration token, when connected
Email address associated with Google SSO, when connected
Profile information and language preference
Registration and last-login timestamps
Subscription plan and billing status
Usage statistics

Helpfeel is explicit that billing status does not include credit card numbers or other payment-method details. The company separately confirmed that no payment information, including card numbers, was disclosed.

The password hash line is still serious. Even without cleartext passwords, cracked or reused credentials become phishing fuel. Session IDs and OAuth-style integration tokens expand the blast radius beyond "change your Gyazo password and forget it."

Image metadata — about 490 million records, plus a filtered set

The second pile is harder for casual users to visualize, and it is where this incident gets ugly for privacy. Helpfeel confirmed roughly 490 million metadata records tied primarily to images registered in or before January 2019 — about 14.4% of all image-related data. Separately, metadata for about 2.4 million images was retrieved with specific filtering criteria and also disclosed.

Metadata fields listed in the notice include:

Image ID used to construct the image URL
Source IP address of the upload
User-Agent string
EXIF location data, if present in the file
OCR text extracted from the image
Image title
Source URL and related metadata
Hashed passphrase for private images

Image ID is not a harmless internal key. Helpfeel says that information can be used to construct Gyazo image URLs and view corresponding images without authorization. That is why the company temporarily disabled viewing of some images. OCR text is another sleeper risk: screenshots of dashboards, customer tickets, Slack threads, and medical portals often leave readable strings in OCR indexes even when the pixel file itself stays on disk.

Helpfeel also confirmed the attacker obtained a list identifying private images. Investigators could not rule out that some private images were viewed. To date, the company has not confirmed loss or deletion of the underlying image binaries themselves — the stated impact is unauthorized disclosure of metadata and the possibility of unauthorized viewing.

What was not exposed

Credit card numbers and payment-method details were not in the disclosed sets, per Helpfeel. Helpfeel and Cosense — sibling products from the same company — use different architectures. Based on the investigation as of September 16, Helpfeel reported no confirmed unauthorized disclosure from those systems. Some images embedded inside Helpfeel and Cosense via Gyazo may still fail to load because Gyazo delivery was suspended during containment.

The unique count of affected people is still unknown. Treat 23.62 million as a record count, not a headcount, until Helpfeel finishes separating anonymous shells from identifiable accounts.

Who is at risk

Anyone who ever created a Gyazo account — including anonymous upload habits that still generated a backend record — should assume their row may be in the dump. Priority audiences:

Registered users with email and password. Rotate the Gyazo password and any reused password elsewhere. Watch for phishing that cites the Gyazo data breach or PIPP Commission language.
Google SSO and X-connected accounts. Integration tokens and SSO emails were in scope when those features were linked. Revoke Gyazo access from Google and X account settings, then re-link only if you still need the product.
Paid subscribers. Plan and billing status leaked; card PANs did not. Still treat subscription emails about "reactivate Gyazo Pro" as suspect until you verify on the official site.
Users of private images. Hashed private passphrases and private-image identifiers were taken. Assume private URLs may be guessable or reconstructible until Helpfeel finishes delivery controls.
People who uploaded screenshots before February 2019. That cohort dominates the ~490 million metadata set. OCR text and EXIF GPS from older captures are long-lived privacy problems even if you deleted the share link years ago.
Workplaces that paste Gyazo links into tickets. Support orgs and engineering teams often treat Gyazo URLs as ephemeral. Metadata plus URL reconstruction means old ticket attachments may become readable to whoever holds the dump.

If you only ever loaded Gyazo images hosted inside Helpfeel or Cosense and never held a Gyazo login, your personal account data on those other products is not confirmed stolen — but embedded screenshots may be offline while delivery stays restricted.

Industry context: why screenshot services are high-value targets

Screenshot hosts sit on a strange intersection of consumer convenience and enterprise leakage. A single capture can contain API keys, customer PII, staging credentials, or a passport photo. Indexing OCR and EXIF makes that content searchable for an attacker who never needs the original high-resolution file.

The Gyazo breach 2026 numbers also show how "legacy" data becomes the majority of a breach. Nearly half a billion metadata rows were mostly pre-2019. Retention policies that keep upload IP, User-Agent, and OCR forever turn a decade-old screenshot habit into a 2026 disclosure event.

Upload-server RCE is a classic class of bug in media pipelines: multipart parsers, image converters, temporary file handling, and privileged workers that process untrusted binaries. Helpfeel did not publish the exact bug class, so do not invent a CVE — but the company's own remediation language points at secure design, authentication and authorization reviews, and hunting for similar issues across other Helpfeel services.

What Helpfeel and regulators said

Helpfeel's September 16 notice is the primary source. It apologizes to users, lists the field inventory above, and commits to ongoing forensics with external specialists. User notification is planned by email where addresses exist, and via the Gyazo web UI for anonymous accounts that cannot be emailed.

Japan's Personal Information Protection Commission received a report on September 15. Helpfeel says it is still assessing reporting duties in other jurisdictions and will notify users on a rolling basis as the investigation clarifies who was actually in the disclosed sets.

Asked actions from the company are straightforward: change your Gyazo password; change reused passwords on other services; treat unsolicited messages about the incident as suspicious. Contact forms are published for Japanese and English support on Gyazo's help sites.

What you should do

Change your Gyazo password now on the official site, not via any email link that arrived this week claiming to be Helpfeel.
Rotate reused passwords wherever you recycled the Gyazo credential. Password hashes in a 23.62 million-record dump will be cracked offline for weak and common choices.
Invalidate connected apps. Disconnect X integration and revoke Gyazo from Google account security settings, then decide whether to reconnect.
Assume private links may be exposed. If you relied on Gyazo private images for sensitive work product, rotate whatever secrets appeared in those screenshots and stop treating old URLs as access control.
Hunt your own OCR risk. Think about screenshots you uploaded that showed customer lists, VPN configs, or internal dashboards — especially before 2019 — and treat those strings as potentially searchable by whoever holds the metadata.
Watch for breach phishing. Expect messages that name Gyazo, Helpfeel, Kyoto, or the PIPP Commission and urge you to "verify your account" or "restore image delivery." Use only URLs you type yourself.
For teams: inventory Gyazo usage in runbooks and ticketing; replace long-lived public screenshot links with ticket attachments stored in systems you control; review whether employees used personal Gyazo accounts for work captures.
Monitor account mailboxes tied to Gyazo for secondary attacks: credential stuffing on other sites, fake invoice threads, or social engineering that quotes your nickname and registration date from the dump.

Was I affected?

Helpfeel has not published a public email lookup portal in the September 16 notice. Notifications will roll out by email and in-product messaging as the company finishes identifying whose records were disclosed. If you have ever registered for Gyazo, or uploaded under an anonymous account that still created backend rows, plan as if your data is in scope until told otherwise.

Anonymous accounts without email are part of the 23.62 million figure. That means "I never signed up" is not a complete defense if you used one-click upload flows that still created user-related records.

Why password hashes and session IDs still matter

Helpfeel listed password hashes among the disclosed user fields and said it had already reviewed authentication-related information for misuse potential, then invalidated and restricted what needed locking down. That sequence is important for anyone asking "was I affected" after the Gyazo data breach.

A hash is not a reusable password by itself, but offline cracking against 23.62 million records will recover weak, reused, and previously breached passwords at industrial scale. Session IDs and device IDs shrink the work for anyone trying to reconstruct how a particular person used Gyazo — which device, which login streak, which plan tier. X integration tokens and Google SSO emails widen lateral movement into other products if those tokens were still valid when stolen.

Helpfeel's notice does not publish the hash algorithm — do not invent one. Assume the credential material is hostile-controlled, rotate everything connected to the account, and treat emails that claim to "confirm your password hash was rotated" as fraud.

Private images, URL construction, and delivery suspension

The metadata pile includes image IDs used to build Gyazo URLs. Combined with a list of private images, that is enough for Helpfeel to worry about unauthorized viewing even when the binary files never left object storage. The company temporarily disabled viewing of some images and suspended delivery more broadly while investigating.

On September 15, Helpfeel resumed delivery for images newly uploaded after the unauthorized-access measures were completed. Older content — especially the pre-2019 cohort that dominates the 490 million metadata records — remained under tighter scrutiny. If a bookmark or Slack message to an old Gyazo link broke that week, that outage was containment, not random CDN weather.

Hashed passphrases for private images were also disclosed. Hashing raises the cost of guessing a passphrase, but it does not erase the risk that URL construction alone exposes content that users believed was gated. Teams that used Gyazo private links as a makeshift access-control layer for screenshots of production data should rotate those secrets as if the link were public.

OCR text and EXIF: the quiet part of the Gyazo breach

OCR extracted from screenshots is where this incident leaves consumer breach territory and enters workplace incident territory. Support engineers paste error dialogs. Founders paste pitch decks. Clinicians and lawyers sometimes paste things they should never have uploaded to a consumer share tool. Those strings live in metadata indexes long after the viral tweet is forgotten.

EXIF location data, when present, can place a person or office at the moment of capture. Upload IP addresses and User-Agent strings add network and device texture. None of that requires the attacker to steal the PNG itself. The Gyazo breach 2026 metadata disclosure is therefore not a footnote under the 23.62 million user records — it is a parallel privacy event measured in hundreds of millions of rows.

Helpfeel has not confirmed loss of image binaries. That is not the same as saying private content could not be viewed once URLs were reconstructible.

Canonical record and sources

BreachHistory indexes this incident at https://breachhistory.com/gyazo/gyazo-helpfeel2026. Primary and corroborating sources used for this write-up:

Helpfeel's investigation is ongoing. Counts, private-image viewing conclusions, and the final unique-person total may change in later updates. When they do, the catalog row and this narrative should be read against the latest company notice — not against rumor threads that invent card-number exposure Helpfeel already ruled out.

For a consumer screenshot product, the Gyazo data breach is a reminder that upload infrastructure is production infrastructure. Arbitrary commands on an image server became tens of millions of account rows and hundreds of millions of metadata records in a matter of days — and the cleanup for private URLs and OCR residue will outlast the initial patch.

If you build tools that accept untrusted media uploads, treat this as a tabletop: what can an attacker run after compromising the converter, and how long do you keep OCR, EXIF, and upload IPs? Check the BreachHistory catalog as Helpfeel's forensics mature — the September 16 apology is a snapshot, not the last word on unique-person counts.