If you’ve used Gyazo for screenshots or quick screen recordings, this one hits close to home. Gyazo confirmed attackers exploited a server vulnerability and stole about 23.62 million user records, with suspicious activity detected the next day and the service taken offline for maintenance while they investigated. The bigger punch: Gyazo also reported exposure of around 490 million image metadata records, mostly tied to uploads before January 2019. Here’s what happened, what might be out there, and the exact steps to take right now to limit fallout.
What Gyazo is—and what happened (clear timeline, no fluff)
Gyazo is a cloud-based screenshot and screen-recording tool that automatically uploads what you capture and gives you a shareable link. That’s the whole point: grab a screenshot, paste a link in Slack/Discord/email, move on. It’s popular in gaming communities and everyday work chats for the same reason—speed and convenience.
That convenience is also why a breach stings. When a service is built around instant sharing, the account and metadata behind that sharing becomes the real asset.
The Gyazo breach timeline (September 2026)
Here’s the clean timeline Gyazo disclosed:
- September 11, 2026 — attackers exploited a server vulnerability
Gyazo says a third party used a server flaw to access its database and steal roughly 23.62 million user records.
- September 12, 2026 — suspicious activity detected, vulnerability fixed
Gyazo detected suspicious activity the next day and says it fixed the vulnerability used in the attack. The catch is simple: by the time something is detected and patched, data can already be gone.
- After detection — service temporarily suspended for maintenance
Gyazo then took the service offline / temporarily suspended it for maintenance while investigating, calling it a preventive measure.
What’s confirmed (and what isn’t)
Gyazo confirmed unauthorized access to its database and disclosure of user information plus metadata associated with uploaded images.
What you don’t get (yet) is a neat answer to “Was my specific account included?” without checking your inbox for a notice and assuming exposure if you’ve had an account for any meaningful amount of time. Next, we’ll get specific about the types of data that may have been exposed—and what those details mean when someone tries to use them against you.
What data may be exposed (and what that means in real life)
Gyazo said the exposed data varies by user. Translation: you shouldn’t assume a “minimal” leak just because you used Gyazo casually. Some accounts will have more attached than others.
1) The user-record side (the part attackers use to log in, reset, or impersonate)
Gyazo listed these data types as potentially exposed:
- Names / nicknames
Often enough to make a phishing email feel “real.” If your Gyazo display name matches what coworkers call you, that’s fuel.
- Email addresses (including Google SSO email addresses)
This is the big one. Your email is the account “root key” for password resets across the internet.
- Password hashes
A hash isn’t a plain-text password, but it can still be cracked (especially if the original password was weak or reused). Once attackers get a working password, credential stuffing starts: they try it on Gmail, Discord, Steam, bank logins—anywhere people tend to reuse credentials.
- User/device IDs + login session IDs
These identifiers can help attackers map activity back to a specific account or device, and sometimes support impersonation attempts with customer support or targeted scams.
- X (Twitter) integration tokens
If you connected Gyazo to X, tokens can raise the risk of account-linking and potential misuse of connected features.
- Profile details, subscription information, billing status, usage statistics
Sounds boring—until it’s used for social engineering. “Your Gyazo Pro billing failed, click to verify” works better when an attacker knows you actually had a subscription.
2) The image-metadata side (~490M records): why “metadata” can still hurt
Gyazo also reported exposure of about 490 million image metadata records, mostly linked to uploads before January 2019.
This metadata may include:
- Image IDs used to construct image URLs
This matters because Gyazo noted image IDs could potentially be used to access corresponding content—so it temporarily disabled access to files whose records were exposed.
- Upload IP addresses and User-Agent strings
These can reveal rough location/network info and device/browser fingerprints. Not identity on its own, but it helps with correlation.
- EXIF location data
If a screenshot or upload preserved location metadata, it can expose where it was created (or at least where the device believed it was).
- OCR-extracted text
This is the sleeper risk. OCR pulls text out of images. If your screenshot contained an address, invoice number, tracking code, internal URL, or a one-time code you thought was “just in a picture,” OCR can turn it into searchable text.
- Image titles and source URLs
These can reveal what you were doing (or where content came from) even if someone never sees the image.
- Hashed passphrases for private images
Private doesn’t mean invisible. Gyazo also said attackers obtained a list identifying private images, and it can’t rule out some were viewed.
If you’re trying to decide how urgent this is: email + password hashes drive account takeover attempts, and image metadata + OCR drives personal exposure. Next up is the 30-minute checklist that reduces both, fast.
Your 30-minute breach response checklist (do this today)
You don’t need a “perfect” plan. You need fast damage control that blocks the two most common follow-ups: credential stuffing and phishing. Set a 30-minute timer and knock these out.
0–10 minutes: Lock down Gyazo access
- Change your Gyazo password
- Make it long and random (a password manager is fine).
- If you’ve ever reused that password anywhere else, treat this as compromised already. Gyazo advised users to change their Gyazo password and any other accounts using the same credentials.
- Log out other sessions (if available)
- Many services let you “log out of all devices.” If Gyazo offers it, use it.
- If it doesn’t, a password change still helps.
10–20 minutes: Stop reuse from turning into account takeovers
- Rotate reused passwords everywhere
Prioritize accounts in this order:
- Email accounts (Gmail/Outlook/iCloud)
- Banking/finance
- Apple ID / Google account
- Social accounts (X, Discord, Steam, LinkedIn)
- Work accounts (SSO, VPN, Slack)
If you’re not sure what you reused, don’t guess. Search your password manager for the old password, or start with your most important logins.
- Turn on MFA where it matters
- Enable MFA/2FA on Gyazo (if offered) and, more importantly, on your email and financial accounts.
- Prefer an authenticator app or a security key over SMS when you have the choice.
20–30 minutes: Harden your email (because it’s the reset key)
- Secure the email account tied to Gyazo
Email is the reset button for almost everything. Do these quick checks:
- Change email password if it’s reused or old
- Confirm MFA is enabled
- Review account recovery options (backup email/phone) for anything outdated or unfamiliar
- Check “recent security activity” / “devices” for logins you don’t recognize
- Turn on sign-in alerts
Most major providers can alert you on:
- new device sign-ins
- suspicious login attempts
- password changes
Turn those on now. It’s the easiest early-warning system you’ll get.
Keep your head on: the phishing pattern to expect
Over the next few weeks, assume you’ll see messages that look like:
- “Gyazo maintenance complete—log in to restore access”
- “Billing failed—update your card”
- “Private images exposed—verify your account”
Treat any link in those emails or DMs as hostile. Go to the site by typing the URL yourself, or use a trusted bookmark.
Ongoing: watch for official updates (without doom-scrolling)
Gyazo said it temporarily suspended service for maintenance and is notifying affected users while investigating.
Keep an eye on official Gyazo communications for:
- service restoration updates
- clarification on affected data
- any new steps they recommend
If you do the checklist above, you’ve already cut off the most likely ways this breach turns into a worse day.
Reduce exposure going forward (small habits that matter)
After you’ve handled the immediate fallout, the goal shifts to reducing your blast radius the next time a service gets hit. With Gyazo, the painful lesson is that “just screenshots” can come with OCR text, EXIF location data, upload IPs, and image IDs tied to URLs.
Treat screenshots like documents (because they basically are)
Before you capture or share, do a 5-second scan for things that can be abused if they ever show up in a breach (or get forwarded to the wrong person):
- Addresses and personal identifiers (shipping labels, patient info, HR docs)
- Invoices and receipts (full names, partial card numbers, account IDs)
- Login states (you’re already signed in; the screenshot becomes “proof” for support scams)
- API keys, tokens, QR codes, invite links (a screenshot can be enough to access something)
- One-time codes (2FA codes, password reset links)
- Maps and photos with possible location metadata (EXIF can expose where something was created)
If Gyazo’s OCR-extracted text was part of the exposed metadata set, any text inside an image can become searchable or usable by attackers without them “reading” the screenshot like a human would.
Don’t let one email address become the key to your whole life
A lot of breach damage happens after the breach: spam, phishing, account-linking, and reset attempts. The fix is simple: compartmentalize your identity.
- Use separate emails for:
- critical accounts (banking, primary email, Apple/Google)
- work tools
- “nice to have” apps (image hosting, forums, random signups)
- Use separate phone numbers when a service demands one (especially for marketing-heavy platforms)
This is where tools like Cloaked fit naturally if you’re the kind of person who signs up for lots of services: you can create masked emails and phone numbers per account, so when one service leaks your contact info, it doesn’t automatically expose the rest of your accounts. It also makes it easier to spot which company sold or lost your data, because the alias getting spammed tells on them.
A quick Gyazo-specific habit check
Gyazo noted that image IDs can potentially be used to access corresponding content, which is why it temporarily disabled access to files whose records were exposed.
Practical takeaway: treat “unlisted” links as shareable, not secret. If it would hurt to see it forwarded, don’t upload it—or blur/crop it before you do.
