Gyazo confirmed a major data breach after attackers exploited a server vulnerability on September 11, 2026, gaining access to its database and stealing approximately 23.6 million user records. Exposed information may include names, email addresses, password hashes, user and device IDs, login session IDs, X integration tokens, Google SSO addresses, profile and subscription details, billing status, and usage data. The attackers also accessed roughly 490 million image metadata records (primarily tied to images uploaded before January 2019) including image IDs, IP addresses, EXIF location data, OCR-extracted text, source URLs, and hashed passphrases for private images. Gyazo said the attackers obtained a list identifying private images and acknowledged that some content may have been viewed, prompting the company to disable access to affected files and temporarily suspend the platform. The vulnerability has since been fixed, and Helpfeel is investigating with external experts and authorities while notifying affected users and advising them to change reused passwords and remain alert for suspicious communications. Out of an abundance of caution, CTIX analysts urge users to renew their passwords, and ensure their software is up-to-date with the latest security updates.