A Gyazo hack took data on 490 million images, location included

5 min read

A picture you shared once and forgot

Most people who share a screenshot or a photo through a website never think about it again. The link works, a friend sees the picture, and the file stays on a server somewhere for years.

In September 2026 that forgotten pile became a target. A break-in at Gyazo, a screenshot and image-sharing service, exposed records tied to hundreds of millions of uploads. Many of them were old. Some carried the place where the picture was taken.

What happened

Gyazo is run by Helpfeel, a Japanese software company. According to Helpfeel's account, as reported by The Hacker News and Help Net Security, an attacker used a weakness in the server that receives image uploads on September 11, 2026. Through it, the attacker could run their own commands on the company's systems and reach the Gyazo database.

Helpfeel says it noticed suspicious activity that evening, Japan time. Early on September 12 it shut off the paths the intruder had been using, ended the intruder's sessions and patched the flaw later that day. By then the data had already been copied, BleepingComputer reported. On September 14 the company paused image delivery and confirmed that data had been exposed. On September 15 it reported the incident to Japan's Personal Information Protection Commission, the national privacy regulator. Its public notice followed on September 16.

The numbers are large. About 23.62 million user records were taken. Depending on the user, they can include a name or nickname, email address, password hash (a scrambled form of the password), user and device IDs, login session IDs, linked X and Google sign-in details, plan and billing status, and usage figures. Helpfeel says no card numbers or other payment details were exposed. It also says the count includes anonymous accounts that never registered an email, so the number of real people affected is lower and is still being worked out.

The attacker also took metadata for about 490 million images, mostly ones uploaded in or before January 2019. Help Net Security put that at roughly 14.4% of the platform's image data. Those records can include the image ID used to build each link, the internet (IP) address the upload came from, details of the device and browser, EXIF location data where the photo had it, text the service had read from inside the image, titles, source web addresses, and scrambled passphrases for private images. Metadata for another 2.4 million images was pulled using filters the company has not described.

Reports do not confirm that the image files themselves were downloaded. Because the stolen image IDs are used to build links, Helpfeel has temporarily blocked viewing of some images. Help Net Security reported that the company said it "cannot rule out the possibility that some private images may have been viewed." Helpfeel says it found no sign that its other services, Helpfeel and Cosense, lost data. It is emailing affected users, posting notices on the Gyazo site for anonymous accounts, and working with outside forensic specialists. When Help Net Security reported on September 21, the Gyazo homepage still showed a maintenance notice with no return date.

How this kind of thing happens

Every digital photo carries a small hidden label called metadata. One common format, EXIF, is written by the camera or phone at the moment the picture is taken. It can record the date and time, the phone model, camera settings and, if location is turned on, the GPS coordinates of the spot. You don't see any of this when you look at the picture, but it travels with the file.

When you upload a picture, the website receives that label along with the image. It also sees your IP address, which can point to a rough area, and the type of device and browser you used. A service may keep this information for years; in Gyazo's case, most of the stolen image records came from uploads made in or before January 2019.

The upload server is the front door that accepts files from the public, so it faces the whole internet. A single flaw there can give an outsider a path to the database behind it. Old data is the quiet part of the risk. A picture can be shared for a moment and forgotten by its owner while the service keeps its records.

Why it matters at home

For many uploads, the harm may be small. A screenshot of a recipe or a meme reveals little. The concern is the photo taken at home, at a child's school or at a regular weekend spot, with location switched on. Joined to an email address and a name, a record like that can show where someone lives or spends time.

Real account details also help scammers. A fake email that mentions a service you really used, and uses your real name, is easier to believe.

Then there is the question of what people agreed to. Someone who used a sharing tool years ago may not have pictured their photo's location sitting in a company database in 2026.

What you can do

• If you ever used Gyazo, change your password there, as Helpfeel advises, and change it on any other site where you used the same or a similar password.
• Watch for suspicious emails or messages about the incident, which Helpfeel also warns about. Go to the company's website yourself instead of clicking links in a message.
• Check your phone camera's settings and decide whether you want location saved in new photos. You can switch it off and turn it back on when you need it.
• Before you post or upload a photo taken at home, look at its details or info panel on your phone to see whether it carries a location.
• Review old accounts on photo and file-sharing sites. Log in, delete uploads you no longer need, and close accounts you don't use.
• Use a different password for each service, so one breach doesn't unlock the others.

Sources

1. BleepingComputer, Sep 18, 2026
2. TechRadar, Sep 17, 2026
3. The Hacker News, Sep 2026
4. Help Net Security, Sep 21, 2026

This article is based on the published reports listed above, written in our own words. Details are as reported on the dates shown. Spotted an error? Email support@krudodesigns.net and we will correct it.