A student in Ohio has used Gyazo since school: one keystroke, a screenshot, a link to paste into Discord. She made the account in 2019 with the password she used everywhere then. This week, because of the Gyazo data breach, that email address and a hash of that password sit in a folder someone pulled out of Gyazo’s database. Next to them sit the IP address and the recognized text of every screenshot she ever took. She has not opened Gyazo in a year, and it does not matter.
Confirmation: the company confirmed it. Helpfeel, which runs Gyazo, published its notice on 16 September 2026 and set out the record counts and the fields itself.
What happened in the Gyazo data breach
On 11 September 2026 an attacker used a vulnerability in Gyazo’s image-upload server to run commands on it and reach the user database. Helpfeel found the intrusion the next day, cut the access off, and disclosed it on 16 September. That is the timeline in Helpfeel’s own notice. BleepingComputer and SecurityWeek picked it up on 18 September.
Gyazo is a screenshot and screen-recording tool: press a key, the capture goes to the cloud, you get a link. It has about 23 million users and holds more than three billion images. It is a fixture in gaming, study and support chats, because the link is faster than the file. The company’s words: “Our investigation confirmed that the third party had accessed Gyazo’s database and that user information and metadata had been disclosed without authorization.”
The counts come from Helpfeel, not from an attacker’s forum post. About 23.62 million user records, including anonymous accounts that had no name set. About 490 million image-metadata records. And a separate set of about 2.4 million images the attacker retrieved directly. That is why the company says it “cannot rule out the possibility that some private images may have been viewed by the third party.” The attacker did not reach payment card numbers.
Helpfeel says it has closed the route in, fixed the flaw, and invalidated authentication data on its side. It also suspended image delivery as a precaution while it worked. It has asked every user to change their password. But it has not said how it hashed the passwords.
What the Gyazo data breach exposed
The user table carried the account itself: name or nickname, email address, password hash, user and device IDs, login session IDs, X integration tokens, Google sign-in email, profile details, language, registration and login dates, subscription plan and billing status. Here is what each item is worth to whoever holds it:
- Email address and password hash. A hash is not the password. But a weak or reused password behind an ordinary hash falls in hours, and attackers then try the pair at every bank, shop and email service on the internet. That is credential stuffing, and it is the main event of this breach.
- Session IDs and X tokens. A live session or token opens an account without any password at all. Helpfeel says it invalidated authentication data. Still, if you had X connected to Gyazo, assume that link is burned and revoke it on X’s side too.
- Device IDs and login dates. Enough to make a fake “new sign-in on your device” email name your actual device and your actual last login.
- Subscription and billing status. Enough to tell a scammer which users pay, and to write “your Gyazo Pro renewal failed” to exactly those people.
The screenshot metadata
The metadata table is the unusual part. Every image record carried the image ID that builds its URL, the IP address and browser that uploaded it, the location from the photo’s EXIF data, the text OCR read off the screenshot, the title, the page it came from, and a hash of the passphrase on private images. Screenshots are where people put the things they mean to send once: a chat, an address, a ticket confirmation, a password someone typed in the open, a bank balance. So the recognized text of ten years of that is in the set, searchable, and tied to an IP address and an email.
What to do now after the Gyazo data breach
Most of this is about the password you used on Gyazo, and almost none of it is about Gyazo.
- Change the Gyazo password, then change it everywhere else you ever used it. Not only where you use it now: the password from 2019 counts. A password manager will tell you where a password repeats. If you do not have one, this is the week to start.
- Turn on the strongest sign-in every important account offers, starting with your email. Use a passkey where available, an authenticator app otherwise, and not SMS if there is a choice. Then a stolen password on its own opens nothing.
- Revoke Gyazo on X and Google. Go to the connected-apps page of each, by typing the address yourself, and remove Gyazo. Reconnect later if you want.
- Expect the follow-up phish dressed as Gyazo. “Confirm your account after the security incident”, “your Pro renewal failed”, “a screenshot of yours was reported”: those messages will quote your real plan and real device, because the data lets them. Do not click. Type
gyazo.comyourself if you need to check anything. - Go through your Gyazo library and delete what should not be there. Look especially for screenshots that show a password, an address, an ID document or a ticket barcode. Deleting does not undo the leak, but it ends the window.
- If the EXIF location data worries you, it should: a photo from your phone carries where you took it. Turn location tagging off for the camera app, and stop uploading phone photos to a screenshot tool.
How OptMsg changes this exposure
Honestly, and at its real size: OptMsg would not have prevented the Gyazo data breach. The flaw was on Gyazo’s upload server, and no choice you make about your own inbox reaches into another company’s database. What an OptMsg account changes is what the stolen pair can do once it is out.
Two things. First, the login. Your OptMsg account has no password, so a password stolen from another site can’t open your inbox. The email-and-hash pair the attacker holds is the login to Gyazo, not the login to your inbox. There is no password on the account for a recovered hash to match. Your email is where most accounts get reset, so keep that door shut and the rest stay shut with it.
Second, the wave. Mail from a sender you have not approved goes to Trash, not your Inbox, and auto-deletes after 30 days. With OptMsg’s patent-pending opt-in technology, the “confirm your Gyazo account” email from a domain you have not seen before lands in Trash. It does not land in front of you with your plan name in the subject. Only people you approve can reach your inbox. Everyone else goes to Trash. And if a message in Trash comes from a sender many other OptMsg users have opted in to, you get a push alert, so a real notice from a real company is not lost.
What that does not cover: the screenshots themselves, which are already out; a session token replayed against Gyazo, which is Helpfeel’s problem to have fixed; a phishing page you open yourself; a message from a sender you did approve whose own account fell; a compromised device; or someone with your unlocked phone. Those are the six steps above.
If you want an inbox where a leaked password is not the master key, see how Security First works, or read why your inbox should not care about a leaked password.
Ready for an inbox that only holds the mail you asked for? Create Your Account.
Your Inbox. Your Rules.
Frequently asked questions
What happened in the Gyazo data breach? On 11 September 2026 an attacker exploited a flaw in Gyazo’s image-upload server and reached its database. Helpfeel, the company behind Gyazo, detected it on 12 September, shut the access off, and disclosed it on 16 September. It confirmed the attacker took about 23.62 million user records and 490 million image-metadata records.
What information was exposed in the Gyazo breach? Names or nicknames, email addresses, password hashes, user and device IDs, login session IDs, X integration tokens, Google sign-in email, profile details, subscription plan and billing status. Image metadata included upload IP addresses, EXIF location data, the OCR text of screenshots, titles, source URLs and hashed private-image passphrases. The attacker did not reach payment card numbers.
Were passwords stolen in the Gyazo breach? Password hashes were, not plain passwords. Helpfeel has not said which hashing algorithm it used. An attacker can recover a short or reused password behind a hash, so change it on Gyazo and anywhere else you used it.
Were my private Gyazo images seen? Helpfeel says it cannot rule that out. The attacker retrieved about 2.4 million images directly, and the stolen records held the metadata of every image, including the text OCR read off it.
Would OptMsg have stopped the Gyazo breach? No. It happened on Gyazo’s servers. What OptMsg changes is the aftermath: there is no password on an OptMsg account for the leaked hash to match, and mail from a sender you have not approved goes to Trash rather than your Inbox, so the fake “confirm your account” email has a shorter path.
Sources
- Helpfeel: Notice regarding unauthorized access to Gyazo — 16 September 2026
- BleepingComputer: Gyazo server flaw exploited to steal 23.6 million user records — 18 September 2026
- SecurityWeek: 23 Million User Records Compromised in Gyazo Data Breach — 18 September 2026
Previous in Breach Breakdown: Florida DMV Data Breach: What ShinyHunters Published, and What to Do Now
Next in Breach Breakdown: BigCommerce Data Breach: A Store App Leaked Shoppers’ Names and Addresses
