Your Private Gyazo Screenshots Are Exposed: Hackers Hit 23 Million Accounts

Gyazo Trusted Your Secrets to a Server That Had a Hole in It

On September 11, 2026, attackers found a bug in Gyazo's image upload server. That bug let them run arbitrary commands on the machine, the kind of access that means they could go anywhere on the system, including the database. Gyazo detected it the next day. By then, the damage was done.

If you have ever used Gyazo to capture a screen, share a link, or quietly host an image you thought was private, your data is now in someone else's hands.

What Did the Attackers Actually Take?

Two things, and they compound each other.

First, 23.62 million user records: names, email addresses, hashed passwords, device IDs, X/Twitter integration tokens, and billing information. Full payment card numbers were not in the breach. Everything else was.

Second, and this is the part that should alarm you more, 490 million image metadata records. That includes the image IDs Gyazo uses to build both public and "private" image URLs. It includes the IP address you uploaded from. It includes EXIF GPS coordinates baked into your screenshots if location data was on. And it includes OCR-extracted text that Gyazo pulled from inside your images.

That last point: the content of your screenshots may be readable to whoever bought this data. Passwords visible on screen. Internal documents. Personal conversations. Gyazo ran text recognition on your uploads and stored the results. Those results were stolen too.

Were Your "Private" Images Actually Exposed?

Gyazo says it cannot rule out that private images were accessed. That is a careful, lawyerly sentence that means: possibly yes.

In response, Gyazo temporarily disabled viewing of certain images. The mechanism for a "private" Gyazo image is a long, hard-to-guess URL. It was never encrypted. It was never gated by login. The privacy came entirely from obscurity, if you did not share the link, nobody could find it. The attackers now have 490 million image IDs. Obscurity is gone.

Why the Password Reuse Angle Is the Real Threat

Password hashing means attackers cannot read your Gyazo password directly from the stolen file. But hashing is not invincible. Weak or common passwords crack fast. If you used the same password on Gyazo that you use on your email, your bank, your work Slack, or anywhere else, that other account is now a target.

This is how the domino falls. Credential stuffing attacks take a leaked email-password pair and try it on hundreds of sites automatically. You do not have to be the target. You just have to be a match.

Gyazo is urging all 23 million users to change their password immediately and update it everywhere they reused the same one. Do not wait for a follow-up email from them.

What to Do Right Now

1. Change your Gyazo password immediately. Log in and change it now, before anything else. Use a password you have never used anywhere else.

2. Find every site where you used the same password and change those too. If that list feels long, a password manager like Bitwarden (free) or 1Password will generate and store unique passwords for every site going forward. This is the moment to start using one if you have not.

3. Enable two-factor authentication on every account that matters. Email, banking, social accounts, anywhere with payment info. An authenticator app is stronger than SMS. If a site offers a passkey instead, use that, it is phishing-proof.

4. Watch for phishing attempts that reference your Gyazo content. Attackers with OCR data from your screenshots know things about you. If an email or message references something specific, a document, a username, a conversation, treat it as a red flag, not a sign of legitimacy.

5. Check your billing statements. Billing information was in the breach. Full card numbers were not confirmed stolen, but monitor for unexpected charges in the next 30 to 60 days.

6. If you had sensitive images on Gyazo, act on that assumption. Assume the content is known. If those images contained passwords, credentials, or private documents, rotate whatever was visible.

The Systemic Truth This Breach Reveals

Gyazo is not unusual. Hundreds of tools that creators, streamers, and developers rely on every day use "hard-to-guess URL" as a privacy model. A long random string of characters in a link feels private. It is not. It is just obscure. Obscurity evaporates the moment a database is reached.

The metadata Gyazo collected, IP addresses, GPS coordinates, OCR text, was not obviously visible to users. You uploaded a screenshot. You did not know the platform was indexing the words inside it and storing the GPS from your phone's EXIF data. That gap between what a service does and what users understand it does is where most breaches land the hardest.

You cannot audit every service you use. But you can control your exposure at the edges. Unique passwords. Two-factor authentication. A skeptical eye on any service asking for location permissions or offering "private" storage via a link alone.

Do This Now

• Change your Gyazo password
• Update the same password anywhere you reused it
• Turn on two-factor authentication on your email and financial accounts
• Treat any message referencing specific details about you as a potential phishing attempt
• Check your billing statements for the next two months

Sources

• bleepingcomputer.com
• thehackernews.com