GoKawiilGyazo breach exposes 23.6 million user records via server vulnerability
Helpfeel-operated screenshot service Gyazo confirmed that attackers exploited a server flaw on September 11, 2026 to access its database and steal roughly 23.62 million user records. The company detected the intrusion the following day, patched the vulnerability, and has taken the platform offline for maintenance while investigating. Exposed data varies by account but can include names, emails, password hashes, session and device IDs, SSO tokens, billing details, and usage statistics, alongside 490 million image metadata records.
GoKawiil's interpretation of the reporting above, not reported fact.
With 23 million users and billions of stored images, Gyazo's breach exposes not just personal identifiers but authentication tokens and session IDs that could enable account takeovers across linked services like Google and X. The scale of leaked metadata also raises privacy concerns for users who assumed their screenshots and links were private or anonymous.
- Attackers exploited a server vulnerability on Gyazo, stealing 23.62 million user records on September 11, 2026.
- Exposed data includes password hashes, session IDs, SSO tokens, and billing information, varying by account.
- Gyazo has taken the platform offline for maintenance after patching the flaw and is still investigating the breach's scope.
YubiKey 5 Series Security Key — With breaches like the Gyazo hack exposing millions of user records, strengthening your own account security is more important than ever. A YubiKey adds hardware-based two-factor authentication that makes it much harder for stolen credentials to be used against you. It's a simple, reusable way to lock down accounts on services that support it.
See YubiKey 5 Series Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-18
Published there as: “Gyazo server flaw exploited to steal 23.6 million user records”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.