Gyazo is the kind of tool people install once and forget about: press a key, and a screenshot is uploaded with a shareable link. On September 11, 2026, an attacker exploited a vulnerability in Gyazo's image upload server and reached its database. Helpfeel, the Kyoto-based company behind Gyazo, says the attacker got about 23.62 million user records and metadata for roughly 490 million images, plus 174 million images users had already deleted. The service went offline and came back on September 27. Even if you haven't opened Gyazo in years, here's what was exposed and what to do.
Table of Contents
What Was Exposed
User Records (~23.62M)
- Names and email addresses
- Password hashes (not plain text)
- User IDs, device IDs, login session IDs
- X (Twitter) integration tokens
- Google SSO emails, profile details, plan and billing status
Image Metadata (~490M)
- Image IDs, titles, and source URLs
- Upload IP addresses and user agents
- EXIF location data
- OCR text extracted from screenshots
- Hashed passphrases for private images
Helpfeel says no payment card information was exposed. It detected the activity the same evening, blocked access by early September 12, and reported the incident to Japan's Personal Information Protection Commission on September 15.
Why Image Metadata Is the Scary Part
Most coverage focused on the 23 million user records, but the metadata may be the bigger privacy problem:
- OCR text means the words inside your screenshots, such as error messages, chat snippets, addresses, and sometimes passwords or API keys, may have been taken as searchable text.
- EXIF location on uploaded photos can point to where you live or work.
- Upload IP addresses connect each image to your network and approximate location over time. That's a long record of where you were when you took each screenshot.
That last point is where a VPN matters: uploads made over a VPN record the VPN server's IP, not your home's. Our guide to hiding your IP address explains why your IP is a more personal identifier than most people realise.
Who's Affected
The 23.62 million figure counts records, not people. About 18.01 million belong to anonymous accounts with no registered email, and about 5.62 million belong to users with an email on file. If you ever used Gyazo, even anonymously, assume your uploads' metadata was included.
What to Do Now: Step by Step
- Change your Gyazo password, which Helpfeel has asked every user to do, and change it anywhere else you reused it.
- Revoke Gyazo's access to X. In X, go to Settings › Security and account access › Apps and sessions, remove Gyazo, and reconnect later if you still need it.
- Review your Google account's third-party access if you signed in with Google.
- Rotate any secrets that appeared in screenshots: API keys, recovery codes, or Wi-Fi passwords you captured on screen. OCR may have exposed them.
- Watch for targeted phishing. Attackers can now write convincing "Gyazo security notice" emails using your real name and account details.
- Turn on two-factor authentication on your email and on any account linked to Gyazo.
- Strip EXIF location from photos before uploading them anywhere in future. Most phones can turn off location tagging in the camera settings.
Lessons From a Bad September
Gyazo wasn't the only big breach in September 2026. Identity-verification provider IDScan disclosed unauthorised access to names and driver's licence numbers, and Trezor confirmed that tens of thousands of US customers' shipping data was stolen through a third-party fulfilment partner. The common thread is that services you barely think about keep detailed records about you. You can't stop every breach, but you can limit how much each one exposes:
- Use a unique password for every service, stored in a password manager
- Delete accounts you no longer use. Deleted images were in this breach, but a deleted account stops new data from piling up
- Use a VPN so services log a VPN IP instead of your home IP. See how to avoid online tracking
Frequently Asked Questions
Was my credit card exposed in the Gyazo breach?
According to Helpfeel, no payment information, including credit card numbers, was disclosed.
Were Gyazo passwords stored in plain text?
No, passwords were stored as hashes. Helpfeel still asked all users to change their Gyazo password and any matching passwords elsewhere.
Can a VPN prevent this kind of breach?
No. A VPN can’t stop a company’s servers from being hacked. It does mean services record a VPN server’s IP instead of your real one, which limits what a breach reveals about your location.
Leave Less Behind in the Next Breach
With CarrotVPN on, apps and sites log a VPN IP instead of your home address. Free WireGuard® VPN for Android, no account required.
Download CarrotVPN Free