The Gyazo data breach, explained in plain words

What is Gyazo?

Gyazo is a free tool, run by the Japanese company Helpfeel, that lets you grab a screenshot or short screen recording and instantly share it as a link. Many people install it once, use it for quick screenshots at work or for games, and then forget it is there. That is exactly why this breach matters: lots of people may have an account without remembering it.

A data breach is when someone gets into a company's systems without permission and takes, or could see, information they should not have. Think of a break-in at a storage unit, where the thief photocopies the paperwork before leaving.

What happened

According to Helpfeel's notice, reported by security news sites, the company noticed suspicious activity on the evening of 11 September 2026. The attacker had found a weakness in the server that receives uploaded images, used it to run their own commands, and reached the database behind the service.

Helpfeel says it cut off the attacker's access early the next morning and fixed the weakness that day. On 14 September it paused the delivery of images while it investigated, reported the incident to Japan's data protection regulator on 15 September, and published its notice on 16 September. Early public messages had described the outage as maintenance.

What was exposed

Helpfeel said about 23.62 million user records were exposed. That figure includes many anonymous accounts with no email address, so the number of real people is lower and was still being worked out. Depending on the account, records could include:

• Email addresses and names or nicknames.
• Password hashes. A hash is a scrambled version of your password, a bit like a fingerprint of it. The company does not store the password itself, but weak or common passwords can sometimes be worked out from their hash by trying billions of guesses.
• Device and login session identifiers, and tokens used to link Gyazo to X (formerly Twitter).

The attacker also took metadata (information about a file rather than the file itself) for about 490 million images, mostly uploaded in or before January 2019. This can include the upload IP address, location data stored inside photos, the image's title and the text Gyazo had read from inside screenshots. Helpfeel said it found no loss of image files and no payment card details were exposed, but it could not rule out that some private images were viewed.

Tip: The text read from screenshots is the sneaky part. If you ever screenshotted something sensitive, such as an account number, an address or a password reset code, that text may have been in the data.

Who is affected?

Anyone who has used Gyazo, especially before 2019, should assume their account details may be in the data. Helpfeel said it would email users it identifies as affected and post notices on its website for anonymous users. It found no sign that its other products were affected.

Some questions were still open when this was written, including exactly what kind of flaw was used and which images had their viewing disabled. We will not guess at those details.

What you should do

1. Change your Gyazo password, or delete the account if you no longer use it.
2. Change the same password anywhere else you used it. Criminals try leaked email and password pairs on banks, shops and email accounts. Use our password generator to make new, unique ones.
3. Check the apps connected to your X account in its security settings, and remove Gyazo if you do not need it.
4. Think about old screenshots. If any showed passwords, codes or financial details, change those passwords or speak to the provider.
5. Turn on two-step sign-in for your important accounts, so a stolen password alone is not enough.
6. Be wary of messages about the breach. Scammers often send fake "breach notifications" with links. Go to the official website yourself instead of clicking.

Want the technical version of why hashing and two-step sign-in help? Read strong passwords and MFA. For a wider view, see why big breaches keep happening.