Gyazo, the image-sharing platform operated by Japanese company Helpfeel, has disclosed that an attacker gained unauthorized access to its systems on September 11, 2026. The company said it cut off the attacker's access the following day and publicly disclosed the incident on September 16.
According to Helpfeel's disclosure, the intruder reached a database containing approximately 23.62 million user-related records, including user names, email addresses, password hashes, device and session identifiers, and tokens for linked X accounts, along with subscription and billing status. The company stressed that this figure includes anonymous accounts, so it does not represent the same number of identifiable individuals.

Image metadata also exposed

The attacker also obtained metadata tied to roughly 490 million uploaded images, most of them registered before January 2019. That metadata includes the image IDs behind Gyazo's share links, along with text extracted from images and, in some cases, location data embedded in uploaded files. The company said no payment card information was included.

Users urged to take precautions

Helpfeel has reported the incident to Japan's Personal Information Protection Commission and said its investigation continues. Security experts advise Gyazo users to change their passwords, change any password reused on other services, review connected Google and X accounts, and treat older shared links as no longer private.