Gyazo (Helpfeel) data breach

What happened

Kyoto-based Helpfeel said on September 16, 2026 that an attacker exploited a vulnerability in the image upload server of its Gyazo screenshot-sharing service on September 11, ran commands on its systems and copied data from the Gyazo database before access was cut off early on September 12. About 23.62 million user records were taken, including names or nicknames, email addresses, password hashes, user and device IDs, login session IDs, X integration tokens and Google sign-in email addresses; the count includes anonymous accounts, so the number of people is still being worked out. About 490 million image metadata records, mostly for images uploaded before January 2019, were also taken, and their image IDs could be used to open those images, so Helpfeel temporarily disabled viewing of some of them. No payment card data was exposed.

What should I do?

1. Change your Gyazo password, and change it anywhere else you used the same or a similar password.
2. If you connected Gyazo to X or signed in with Google, review connected apps in those accounts and remove any you don't recognize.
3. Assume any older Gyazo capture link could be seen by others; delete captures that show private information such as documents, chats or account details.
4. Watch for phishing emails that mention Gyazo or Helpfeel, and don't sign in from links in them.

Check the other services you use →