Gyazo’s Breach Exposed the Data Behind Private Screenshots

Update, 31 October 2026: Helpfeel’s final investigation confirms access to 432 image files involving 133 users. The dated updates below explain that finding, deleted-image metadata and the service’s viewing restrictions.

In its 16 September notice, Helpfeel said an attacker exploited a flaw in Gyazo’s image-upload server on 11 September, obtained unauthorised access and executed arbitrary commands. The company detected suspicious activity that evening, blocked the identified routes by early 12 September and later confirmed that data had left its systems.

The breach was bigger than a user table

Helpfeel confirmed the unauthorised disclosure of approximately 23.62 million user-related records. The fields vary by account but can include names, email addresses, password hashes, device and session identifiers, profile information, subscription status and integration tokens. The company says payment-card data was not exposed.

The second dataset is the more unusual risk. Approximately 490 million metadata records, mainly for images registered in or before January 2019, were disclosed. Helpfeel says this represented about 14.4 per cent of all image-related data. Another 2.4 million metadata records were retrieved through separate filtering.

• Image identifiers used to construct URLs
• Source IP addresses and browser user-agent data
• EXIF location information where present
• OCR text extracted from screenshots
• Image titles and source URLs
• Hashed passphrases for private images

That combination can reveal more than a conventional account breach. OCR can turn pixels into searchable secrets. EXIF fields can identify a place. Source URLs and IP addresses can connect a capture to an organisation. An image identifier can matter if it helps reproduce the route to the underlying content.

Possible access is not proof that every image was opened

The initial notice did not establish that all 490 million images were downloaded or viewed. It said some metadata was used to construct image URLs and could therefore expose private images. At that stage, the confirmed disclosure concerned user information and metadata, while access to individual images remained under investigation.

The service temporarily disabled delivery of some images while applying countermeasures. A later service update described continuing availability effects. Users should not interpret a restored image as evidence that it was or was not accessed during the incident.

Treat old screenshots as retained records

• Reset the account password when account access is available. Change any reused password elsewhere and review active sessions and connected integrations.
• Search for exposed secrets. Review what was captured in older screenshots. Rotate credentials, tokens and recovery codes that may still be valid.
• Check location and customer data. Consider whether screenshots contained addresses, health data, financial details or other regulated information.
• Review enterprise use. Organisations should identify teams that used Gyazo for support, engineering or incident evidence and include anonymous uploads where records permit.
• Preserve the timeline. Keep Helpfeel notifications, relevant access logs and rotation records. Do not destroy evidence before deciding whether notification or incident-response duties apply.

The strategic lesson is uncomfortable: a screenshot platform is also a document repository, an identity store and sometimes a shadow secrets manager. Retention, access control and deletion rules should reflect what the images contain, not how casually they were created.

Update, 31 October 2026: what Helpfeel’s later notices established

25 September: deleted images left metadata behind

Helpfeel’s second notice added approximately 174 million metadata records associated mainly with images or accounts deleted in or before February 2023, about 5.1 per cent of all images. That cutoff concerns the date of deletion, rather than the upload date. The company said the corresponding deleted image files were inaccessible and were excluded from this newly identified disclosure.

The same notice clarified the account totals. About 18.01 million records, approximately 76 per cent, concerned anonymous accounts without registered email addresses; about 5.62 million, approximately 24 per cent, concerned accounts with email addresses. These are account records, rather than a count of distinct people, and the rounded components do not add perfectly to the declared 23.62 million total. The separate filtered metadata set represented about 0.07 per cent of all images.

Helpfeel also said the disclosed X integration tokens alone could not be used to log in to or operate X accounts, and that it had invalidated the relevant OAuth authentication information as a precaution. This clarification concerns those tokens. It does not establish that every secret visible inside an uploaded screenshot had been revoked.

27 and 29 September: service restoration preserved a viewing boundary

Helpfeel says Gyazo resumed service on 27 September after additional security reviews and countermeasures. Its resumption notice says pre-incident images were initially restricted to their owners. Restoring delivery returns each image to its earlier visibility setting, which may include “Anyone with the link”. Users therefore need to inspect the content and its permissions before restoring it. A recovered service is not evidence that an individual image escaped access during the breach.

A 29 September, 21:30 JST update introduced a Gyazo Teams exception: other members of the same team could view suspended images, except those marked “Only me”. Password-protected images still required their passwords. The company also temporarily allowed Free-plan users to review older images that were normally outside their accessible history. These distinctions matter when checking organisational use and deciding which material should become viewable again.

21 October: confirmed access to 432 image files

Helpfeel’s final investigation notice, covering findings confirmed as of 20 October, identifies 432 image files belonging to 133 Gyazo users that the attacker viewed or obtained. The company says it individually notified those users and identified the images involved. This is a confirmed subset of image access, alongside the much larger metadata disclosure.

The investigators found no record of large-scale acquisition of image files or acquisition of deleted image files. Helpfeel nevertheless continues to allow for additional views through URLs present in the disclosed metadata. The absence of a bulk-download record cannot settle the history of every image.

The final report confirmed a flaw in Helpfeel’s own content-conversion processing. Externally supplied input could be interpreted as server commands. The intruder then reached an accessible database, read large quantities of information and sent data to an external server. Helpfeel attributed the cause to its own system and ruled out a third-party software or service-provider supply-chain cause.

There is a significant evidence limit behind the record totals. Logs established bulk database reads and a large outbound transfer from the same server, but did not capture the transmitted contents. The external investigators could not directly determine the precise fields or number of records sent. Helpfeel retained its declared scope of approximately 23.62 million account records, 490 million image-metadata records, 2.4 million separately filtered metadata records and 174 million deleted-image metadata records.

Password-related disclosure concerned one-way hashes, rather than plaintext passwords. Helpfeel says it invalidated certain authentication and external-integration information. Its final investigation found no evidence of direct intrusion or disclosure from the separate Helpfeel and Cosense systems, and it says the identified images belonging to the 133 users contained none of those services’ customer information. Organisations still need to assess their own Gyazo uploads, including anonymous use and any separately exposed secrets.

As of 20 October, Helpfeel reported no confirmed misuse of personal information, impersonation, financial loss or other secondary harm, and no discovery of the disclosed information being published or offered for sale through its monitoring. That finding coexists with the confirmed access to the 432 image files. The company said monitoring would continue for at least a year.

Rolling user notifications had begun on 20 September. The final notice also identified approximately 57,000 accounts with available contact email addresses, including deleted and cancelled accounts, that might be affected by the deleted-image metadata disclosure. It said notifications to that group would begin after the final notice. Those planned messages are separate from the individual notices already sent to the 133 users with identified image access. Helpfeel also reported contact with Japanese authorities and data-protection authorities in about 30 countries and regions.

The final notice promises a 60-day deletion policy for metadata after an image is deleted, cleanup of historical deleted-image metadata subject to reporting and legal-preservation needs, and retention limits for deleted-account information. These were announced measures to establish and implement. The report does not demonstrate that the new policy had already been fully implemented.

For users, the immediate priority remains changing Gyazo and reused passwords if that has not been done, reviewing the precise images named in individual notices, and checking old captures for still-valid secrets. Helpfeel says its incident-notification emails will not ask recipients to follow a URL or act on a linked website, and it will not request passwords or card numbers. Open the official service independently when checking a notice.

Sources

• Helpfeel, notice and apology regarding unauthorised access to Gyazo, published 16 September 2026. No publication time was provided.
• Helpfeel, service impact update, published 18 September 2026. No publication time was provided.
• Gyazo user notice, published 16 September 2026. No publication time was provided.
• Helpfeel, second incident notice, 25 September 2026.
• Helpfeel, service-resumption notice, describing the 27 September restoration and 29 September Teams update. Incident times in these notices are stated in JST.
• Helpfeel, final investigation results, 21 October 2026, covering information confirmed as of 20 October.