Gyazo Breach: 23.62 Million Records Stolen via Upload Server Flaw

Helpfeel, the Japanese company that owns Gyazo, confirmed that on September 11, 2026, attackers compromised the image upload server of the screenshot service widely used by developers and IT professionals. The breach exposed approximately 23.62 million user records and nearly 490 million image metadata records, turning a perimeter flaw into a deep-seated problem for anyone who used the platform to share terminal output, code, and sensitive configurations.

The Mechanism: Upload Server, Arbitrary Commands, and Database Access

The source cites Helpfeel's official notification: the attacker "exploited a vulnerability in its image upload server" to "gain unauthorized access to Gyazo's systems and run arbitrary commands." This phrasing, reported by Help Net Security and confirmed by The Hacker News, indicates an attack path that starts at the perimeter — an internet-exposed server managed to receive media files — and extends laterally to the central database.

Suspicious activity was detected on the evening of September 11, 2026, with access blocked in the early hours of September 12 and the vulnerability patched within the same timeframe. Helpfeel reported the incident to Japan's Personal Information Protection Commission on September 15. The public notification appeared on September 16, according to the timeline reported by The Hacker News.

The Gyazo service was still under maintenance at the time of writing, with no communicated restoration timeline. Helpfeel explicitly ruled out compromise of the related Helpfeel and Cosense services.

The Amplifying Data: 490 Million Metadata Records and OCR as Attack Surface

The impact is not merely numeric. The approximately 490 million metadata records — about 14.4% of image data according to Help Net Security — include technical information that turns every screenshot into a reconstructible entry point: image IDs used to generate direct URLs, upload IPs, user agents, EXIF geolocation data, titles, source URLs, and, most critically, "OCR text extracted from images."

"Gyazo is a screenshot tool. Developers use it constantly to share what is on their screen, which means those images contain terminal output, API keys, credentials in config files, internal application screenshots, and sensitive documents... Whatever text was visible in those screenshots is now in an attacker's hands as searchable, indexed data, not just pixels" — Michael Bell, Founder and CEO of Suzu Labs

This quote, reported by Infosecurity Magazine, defines the specific problem of this case. The OCR feature, designed to make images searchable, created a parallel textual database alongside the visual content. An attacker accessing this metadata does not face binary files to analyze, but text already extracted, indexed, and queryable. For developers who use Gyazo to share terminals and configurations, the jump from "exposed image" to "searchable credential" is immediate.

Seemant Sehgal, CEO of BreachLock, emphasized in the same source that "EXIF coordinates, OCR-extracted text, session IDs, and image URL construction data give an attacker enough to reconstruct user behavior and location history." The overlap between technical metadata and extracted semantic content constitutes the core risk of this breach.

Gyazo Privacy: 32-Character IDs and "Private" Images

The Hacker News technically analyzed Gyazo's privacy model, based on URLs with 32-character image IDs. This architecture, described by the source as "security through obscurity," makes images theoretically undiscoverable without knowing the full identifier. However, the metadata exposure includes exactly the data needed to construct these URLs: the source cites Helpfeel stating that "information used to construct Gyazo image URLs... could be used by a third party to access and view the corresponding images without authorization."

The dossier also documents that the attacker obtained "a list identifying private images" and that Helpfeel "cannot rule out the possibility that some private images may have been viewed." Private images on Gyazo are protected by passphrase, but the exposed metadata includes "passphrase hashes for private images." The hashing algorithm is not specified in the source, making it impossible to assess resistance to potential offline attacks.

Gyazo temporarily suspended viewing of some images as a precautionary measure, but the number of images actually viewed by the attacker remains an unclarified point.

Timeline and Dossier Limits

The consolidated timeline from sources converges on these dates: initial exploit on September 11, 2026; detection and containment overnight between September 11 and 12; vulnerability patch on September 12; data exposure confirmation on September 14; report to Japanese authorities on September 15; public notification on September 16.

The brief does not identify the exact technical nature of the vulnerability in the upload server. No specific CVE emerges, nor attribution to a known threat actor or group. Also unspecified: the hashing algorithm for passwords and passphrases, the validity of exposed session IDs, the filtering criteria applied to extract 2.4 million additional images (a figure reported by The Hacker News), and the precise service restoration timeline.

Why It Matters

The Gyazo case is not a generic database breach. The relevant core lies in the intersection of a perimeter flaw — an exposed upload server — and product features that transformed visual content into structured, searchable data. OCR, designed for user convenience, created an attack surface that requires no forensic image analysis: the text is already extracted and indexed.

For the industry, the dossier offers a case study on two converging trends: the accumulation of metadata at billion-record scale and the risk that "convenience" features amplify breach impact. For users and developers, the source documents no specific remedial measures beyond the temporary suspension of some images and notification to authorities. The exact nature of exposed X tokens and their revocation status are not detailed in the brief.

The lack of a structured advisory from the vendor or a CVE coordination body, combined with the absence of details on the upload server vulnerability, leaves an area of opacity that prevents a complete technical assessment of the risk perimeter. The brief also does not specify whether the 2.4 million images with "specific filtering criteria" overlap with the 490 million metadata records or constitute a separate set.

Sources

• https://www.helpnetsecurity.com/2026/09/21/helpfeel-gyazo-data-breach/
• https://thehackernews.com/2026/09/gyazo-breach-exposes-2362-million-user.html
• https://www.infosecurity-magazine.com/news/experts-gyazos-breach-490-million/
• https://www.schneier.com/blog/archives/2026/09/reverse-engineering-flock-cameras.html
• https://www.bleepingcomputer.com/news/security/gyazo-server-flaw-exploited-to-steal-236-million-user-records/
• https://www.bleepingcomputer.com/news/security/sakura-internet-hack-exposes-data-of-up-to-136-million-accounts/
• https://www.bleepingcomputer.com/news/security/ernst-and-young-discloses-data-breach-after-support-system-hack/
• https://www.schneier.com/essays/archives/2024/05/llms-data-control-path-insecurity.html
• https://thehackernews.com/
• https://thehackernews.com/p/upcoming-hacker-news-webinars.html
• https://thehackernews.com/search/label/Threat%20Intelligence

Information is based on cited sources and current as of publication.

Sources