Gyazo Data Breach
Visual sharing and screenshot platform Gyazo suffered a major data breach on September 11, 2026, following the exploitation of a remote code execution vulnerability in its image upload infrastructure.
Exposed Data Types
6- Email addresses
- Passwords
- Usernames
- API tokens
- Device information
- User activity logs
About This Breach
Operator Helpfeel Inc. disclosed that an unauthorised actor compromised internal systems and backend databases before containment actions were completed.
The incident exposed approximately 23.6 million user account records. Compromised information includes email addresses, usernames, salted password hashes, device identifiers, and third-party integration tokens. Helpfeel confirmed that financial records and payment card details are processed externally and were not involved in the breach.
A critical facet of the breach involves metadata and optical character recognition (OCR) text indexing approximately 490 million historical screenshots. Captured configuration files, internal credentials, and tokens extracted via OCR present potential secondary exposure risks. Impacted users should promptly update credentials across affected accounts and monitor for targeted phishing attempts.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
