Gyazo Image‑Sharing Service Discloses Massive Data Breach Impacting Over 23 Million Users

Gyazo, the image‑sharing platform owned by Kyoto‑based Helpfeel, disclosed a security incident that compromised the personal data of more than 23 million users.

The breach, detailed in a notice released on Wednesday, revealed approximately 23.62 million user records that included email addresses and password hashes, alongside roughly 490 million entries of image metadata such as timestamps and file identifiers.

Gyazo has become a popular tool for quick screenshot uploads and link sharing, attracting both casual users and professionals who rely on its simple interface. The service’s growth over the past several years has resulted in a sizable repository of visual content and associated user information.

Security experts warn that the exposure of email addresses paired with password hashes creates a ripe environment for credential‑stuffing attacks, especially if users recycle passwords across services. In addition, the sheer volume of image metadata could enable tracking of user activity patterns or the reconstruction of personal timelines.

Helpfeel’s statement urged affected users to change their passwords immediately and recommended enabling two‑factor authentication where available. The company also said it has engaged external cybersecurity firms to investigate the incident and is working to bolster its defensive measures.

The incident arrives amid a wave of high‑profile data breaches worldwide, underscoring the challenges faced by companies handling large volumes of personal and visual data. Regulators in Japan and abroad are increasingly scrutinizing how firms protect such information under privacy laws like the GDPR and Japan’s APPI.

Authorities have been notified, and a formal investigation is expected to examine the breach’s root cause and any potential negligence. Users are advised to monitor their accounts for unusual activity and to consider using unique, strong passwords for each online service.