ScamWatch USA
Log in
Back to Scam Alerts
MODERATE THREAT · Data Breach

Consumer Alert: Gyazo Data Breach Affects 23.6 Million Users

On September 11, 2026, the image-sharing service Gyazo, operated by Helpfeel, suffered a significant data breach after an unauthorized third party exploited a vulnerability in its image upload server. The incident resulted in the exposure of approximately 23.62 million user records and 490 million image metadata records.

10/4/2026Gyazo

Warning signs

  • Receipt of unexpected password reset requests
  • Increased spam or phishing emails targeting your Gyazo-associated email address
  • Unauthorized activity on linked third-party accounts (e.g., X/Twitter)
  • Notifications from identity monitoring services regarding leaked credentials

What you should do

  • Change your Gyazo account password immediately
  • Update your password on any other services where you reused the same credentials
  • Enable multi-factor authentication (MFA) on all sensitive accounts
  • Revoke access for Gyazo within your X (Twitter) settings if you previously linked the account
  • Monitor your email and financial accounts for suspicious activity or phishing attempts
Helpfeel, the parent company of the screenshot and screen-recording tool Gyazo, confirmed that attackers gained unauthorized access to its systems by exploiting a vulnerability in an image upload server, allowing for the execution of arbitrary commands. The breach, which was disclosed on September 16, 2026, affected approximately 23.62 million user records. Compromised information includes names, email addresses, password hashes, user and device IDs, X (formerly Twitter) integration tokens, profile information, usage statistics, and billing information. While payment card data was not compromised, the breach also exposed 490 million image metadata records. Gyazo suspended its service temporarily to remediate the vulnerability and resumed operations by September 27, 2026.

Sources

https://updates.gyazo.com/sitemap.xmlhttps://www.securityweek.com/23-million-user-records-compromised-in-gyazo-data-breach/https://cybernews.com/security/helpfeel-gyazo-data-breach-exposed-millions-recordshttps://breached.company/gyazos-23-6-million-record-breach-saas-providers-should-learnhttps://www.securityweek.com/gyazo-data-breach-exposes-23-million-user-records