Gyazo Service Breach Exposes Data of 23 Million Users

Helpfeel, the company behind the popular image‑sharing tool Gyazo, announced that a security incident has compromised the personal information of approximately 23 million user accounts. The breach was traced to a flaw in the service's image‑upload server that allowed an unauthorized party to retrieve stored data.

Gyazo, which lets users capture screenshots and upload them instantly to the cloud, is widely used by individuals, developers, and businesses for quick visual communication. Its ease of use has made it a staple in many online workflows, meaning the platform holds a large volume of user credentials and usage logs.

According to the company's statement, the attacker exploited a vulnerability in the upload pipeline that had gone undetected until recent internal investigations. The flaw permitted direct access to the backend database where user records are kept. Helpfeel disclosed the incident after learning of the compromise from security researchers and subsequently notified the media outlet SecurityWeek, which first reported the breach.

The compromised data set is believed to include usernames, email addresses, hashed passwords and IP address information tied to each account. While the company has not confirmed the presence of payment details, the type of information typically stored by Gyazo makes it a valuable target for credential‑stuffing attacks and phishing campaigns.

In response, Helpfeel said it has patched the vulnerable code, initiated a forced password reset for all affected accounts, and is working with third‑party security firms to conduct a thorough forensic review. Users have been urged to update their passwords, enable two‑factor authentication where available, and monitor their accounts for any suspicious activity.

The incident adds to a growing list of breaches affecting image‑hosting and file‑sharing services, highlighting the challenges of securing platforms that handle large volumes of user‑generated content. Regulators may scrutinize the company's handling of the breach under data‑protection laws, and cybersecurity experts stress the importance of regular security audits, prompt patch deployment, and transparent communication with users in the event of future incidents.