Gyazo Confirms Breach Exposing 23.62 Million User Records
Summary
Gyazo says attackers exploited a server vulnerability, stealing about 23.62 million user records and exposing 490 million image metadata records. The company took the service offline and advised users to change passwords.
Key points
- Gyazo says attackers exploited a server vulnerability on September 11, 2026, and accessed its database.
- The breach exposed approximately 23.62 million user records, potentially including email addresses, password hashes, session IDs, and integration tokens.
- The incident also exposed 490 million image metadata records, including image IDs, upload IP addresses, EXIF location data, OCR text, and hashed passphrases for private images.
- Gyazo said image IDs could potentially enable access to corresponding content and temporarily disabled access to files whose records were exposed.
- The company could not rule out that some private images were viewed, but said it found no evidence of data deletion.
- Gyazo took the service offline, notified affected users, and is investigating with external experts; it reported no evidence of data theft from its other Helpfeel and Cosense services.
- Users were advised to change Gyazo passwords and reused passwords elsewhere, and to watch for suspicious communications.
Article Details
- Victim Organization
- Gyazo
- Incident Type
- Server vulnerability exploitation resulting in unauthorized database access and data theft
- Incident Date
- 2026-09-11
- Data Types Exposed
- Names and nicknames
- Email addresses
- Password hashes
- User and device IDs
- Login session IDs
- X integration tokens
- Google SSO email addresses
- Profile details
- Subscription information
- Billing status
- Usage statistics
- Image metadata, including upload IP addresses, User-Agent strings, EXIF location data, OCR-extracted text, image titles, source URLs, and hashed passphrases for private images
- Information identifying private images
- Affected Records
- Approximately 23.62 million user records and 490 million image metadata records
- Operational Impact
- Gyazo temporarily suspended the service for maintenance and disabled access to files whose records were exposed. The company said it found no evidence of data deletion.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed
Products
CosenseThe company also found no evidence that its other Helpfeel and Cosense services had data stolen.GyazoGyazo confirmed a data breach after attackers exploited a server vulnerability and stole approximately 23.62 million user records, prompting the company to take the service offline for maintenance.