Gyazo account hacked? Here’s what to do
Move fast and in the right order: reclaim the account through Gyazo’s official flow, kick the attacker out of every session, then close the door they came through — usually a password that leaked in a breach and was reused.
September 2026: 23.6 million Gyazo account records and 490 million image records were stolen
Helpfeel, the Japanese company behind the Gyazo screenshot tool, said on 16 September 2026 that an attacker had used a flaw in an upload server to get into its backend on 11 September. About 23.62 million user records were copied: names or nicknames, email addresses, password hashes, device and session IDs, X (Twitter) connection tokens and Google sign-in emails. So was metadata for about 490 million images, mostly uploaded before 2019, including the IDs that make up image links, upload IP addresses, location data from photos and text read off the screenshots. Helpfeel asks every Gyazo user to change their password. On 24 September it took the whole service offline for security maintenance.
Helpfeel’s notice of 16 September 2026 (updated 24 September), as reported by The Hacker News and TechRadar (17 September), BleepingComputer (18 September) and Help Net Security (21 September 2026)
If your Gyazo account was hacked: start recovery at the official page (help.gyazo.com/Reset%20your%20password-5de75e1e040e1d0017df4370), change the password to a unique one, sign out all other sessions, and re-check the recovery email and phone on the account. Then find out how the attacker got in — check whether your password appears in known breach data — and turn on two-factor authentication so it can’t happen again.
Recover your Gyazo account, step by step
These steps follow Gyazo’s official process. Official links only: account recovery · password reset.
Change the password on every other account where you reused your Gyazo password, starting with email, banking and anything that holds payment details. A hashed password can still be cracked if it was short or common.
When Gyazo is back online, reset your Gyazo password through the official help page, or from Settings under Security & privacy if you are still signed in. Check that the reset email comes from no-reply@gyazo.com before you click anything in it.
Open X and your Google account security settings and remove Gyazo from the list of connected apps, then reconnect later only if you still need it.
Go through your Captures page and delete old uploads that show documents, card or bank screens, addresses, private chats or recovery codes. If you no longer use Gyazo, deleting the account removes every capture at once (cancel Gyazo Pro first).
For the next few months treat any email that claims to come from Gyazo or Helpfeel and asks you to confirm your account, pay, or open a screenshot as a phishing attempt. Go to gyazo.com or help.gyazo.com yourself instead of following the link.
What trips people up with Gyazo
- Gyazo is offline for security maintenance as of 24 September, so the password change Helpfeel asks for may have to wait. Change the same password everywhere else you used it today, because that part does not depend on Gyazo coming back.
- The OCR text is the part people forget. If you ever captured a bank page, a shipping label, an ID card, a chat or a recovery code, the words on that screenshot may now sit in a stolen database even though the image file itself was not taken.
- A Gyazo link works for anyone who has it, and the stolen image IDs are exactly what those links are built from. Once the service is back, delete old captures that show documents, addresses or account details instead of assuming nobody will guess the address.
- If you connected X or signed in with Google, Helpfeel says the stolen tokens were invalidated. Removing Gyazo from the connected apps list in your X and Google security settings costs a minute and closes the door on your side as well.
- Screenshots taken on a phone can carry the location where they were made. Old uploads from before 2019 are the ones in the stolen set, so a home address can be read from the metadata even if the picture itself shows nothing personal.
What happened at Gyazo in September 2026
On 11 September 2026 someone found a hole in one of the servers Gyazo uses to receive uploads and used it to run their own commands on the company’s systems. Helpfeel spotted the activity that evening and had cut off the routes and fixed the flaw by the early hours of 12 September. It confirmed on 14 September that data had been taken, reported the incident to Japan’s Personal Information Protection Commission on 15 September and published a notice on 16 September. The story reached English-language security press the next day.
Two separate sets of data left the building. The first is the account table: about 23.62 million records with whatever name or nickname the user typed in, the email address, a hash of the password, user, device and login-session IDs, the token that links an X (Twitter) account if one was connected, the Google address used for sign-in, profile details, language, sign-up and last-login times, and the subscription plan and billing status. Helpfeel says no card numbers or other payment details were exposed, and it says it has already invalidated or restricted the session and connection credentials that were taken.
The second set is what makes this breach unusual. Metadata for roughly 490 million images, mostly uploaded in or before January 2019 and about 14.4% of everything Gyazo holds, was copied too. That includes the image ID that forms each gyazo.com link, the IP address and browser the image came from, GPS location if the photo carried it, the text Gyazo’s OCR read off each screenshot, the image title and source URL, and hashed passphrases for private images. Gyazo links were never secret by design: the help pages say anyone who has the link can open the image. Helpfeel has switched off viewing for some images and says it cannot rule out that some private images were seen. On 24 September it suspended the service entirely for security maintenance.
Still logged in? Lock the account down now
If you can still get in, you're racing the attacker. In this order: change the password to a long, unique one; sign out all other sessions/devices (the setting exists in Gyazo's security settings); confirm the recovery email and phone number are yours (attackers quietly add their own so they can "recover" the account later); remove unfamiliar linked apps or API access; and turn on two-factor authentication. Only then deal with anything the attacker posted, sent or bought.
Got a "new login" alert from Gyazo?
Treat it as real but verify it the safe way: never tap the link in the message itself (fake login alerts are a top phishing template for Gyazo). Open the app or type the address yourself, check the active-sessions list in security settings, and if you see a device or location you don't recognize, sign it out and change your password immediately. If the alert was genuine, that password is burned — assume it's circulating and change it everywhere else you reused it.
Locked out of Gyazo — email or phone was changed
This is the worst-case scenario and the most common complaint: the attacker changed the account email, phone number or password so the normal reset flow emails them, not you. Do NOT keep triggering password resets — they go to the hacker. Go straight to Gyazo's dedicated recovery flow (link above), which is built for exactly this case: it verifies you by your original signup details, previous passwords, linked devices or a government ID / selfie check, bypassing the stolen email. Watch for the security notice Gyazo sent to your OLD email when the address was changed — it usually contains a "revert this change" link that works for a limited time and is the fastest way back in.
Why this happened — and how to make sure it can’t again
About a third of account takeovers are credential stuffing: a password you used on Gyazo (or the email behind it) leaked in some other company’s breach, and attackers replayed it here automatically. The FBI’s IC3 logged over 5,100 account-takeover complaints with $262M in losses in 2025 alone (IC3). Even when Gyazo itself was never breached, your reused password from another site opens it.
So after recovery, check what’s already out there: our free scanner shows which known breaches and dark-web dumps include your email — and whether passwords were exposed with it.
Check my exposure — free →After you recover: three doors to close
- Unique password + 2FA. A password manager plus app-based two-factor stops both stuffing and phishing replays.
- Reset everywhere you reused that password — email first (it’s the master key), then bank, then the rest.
- Shrink your public footprint. Attackers research targets on data-broker sites (your address, phone, relatives — enough to social-engineer support lines). Our free opt-out guide covers 190 of them, step by step.
Hacked Gyazo account, answered
How did my Gyazo account get hacked?
The most common cause isn't a hack of Gyazo itself — it's credential stuffing: a password you used on Gyazo leaked from some other site's breach, and attackers tried it here automatically. Roughly a third of account takeovers happen this way, with phishing (fake Gyazo login pages and alerts) close behind. That's why the first fix is a unique password, not just a new one.
Can I get my Gyazo account back?
Usually yes. Use the official recovery flow (https://help.gyazo.com/Reset%20your%20password-5de75e1e040e1d0017df4370) — it can verify you even when the attacker changed the email and password. Be patient and respond quickly to follow-ups so the case stays open.
Should I just make a new Gyazo account instead?
Not until you've tried recovery. The old account keeps your history and contacts — and while the attacker controls it, it will be used to scam people who trust you. Recover it, or at minimum report it as compromised so Gyazo can lock it, before you start over.
Was Gyazo hacked in 2026?
Yes. Helpfeel, which runs Gyazo, said on 16 September 2026 that an attacker exploited a flaw in an image upload server on 11 September and took about 23.62 million user records plus metadata for about 490 million images. The company fixed the flaw by 12 September and reported the breach to Japan’s privacy regulator on 15 September.
What data was stolen in the Gyazo breach?
From accounts: names or nicknames, email addresses, password hashes, user, device and session IDs, X connection tokens, Google sign-in emails, profile and subscription details. From images, mostly uploaded before 2019: the IDs used to build image links, upload IP addresses, browser details, photo location data, text read from screenshots by OCR, titles, source URLs and hashed passphrases for private images. Helpfeel says card numbers were not exposed.
Were my Gyazo screenshots leaked?
Helpfeel says the image files themselves were not deleted and the stolen data is metadata, but that metadata includes the image IDs that make up Gyazo links and the text read off each screenshot. The company has disabled viewing of some images and says it cannot rule out that some private images were viewed. Treat anything sensitive you ever uploaded as possibly seen.
Do I need to change my Gyazo password?
Yes. Helpfeel asks all Gyazo users to change their password and to change it on any other service where the same one was used. Gyazo went offline for maintenance on 24 September 2026, so do the other accounts first and the Gyazo reset once the service returns.
Why is Gyazo down?
On 24 September 2026 Helpfeel added an update to its breach notice saying it was carrying out maintenance to secure Gyazo and had suspended the service temporarily. It gave no return date at the time.
How do I know if my Gyazo account was in the breach?
With about 23.6 million records taken, assume yes if you have ever had a Gyazo account. The data has not turned up in known breach databases so far, so a breach checker will not show it yet. That can change if the file is published.
How do I stop my Gyazo account being hacked again?
Three things close most of the doors: a unique password (a manager makes this painless), app-based two-factor authentication, and shrinking your exposed footprint — checking your email against known breach databases and removing your personal data from data-broker sites that attackers use to research targets.