Gyazo Data Breach Exposes 23 Million User Records via Upload Server Flaw

Attackers exploited an arbitrary command execution vulnerability in Gyazo’s image upload infrastructure to breach the popular screenshot platform’s backend database, compromising more than 23.6 million user records and nearly half a billion image metadata entries. The Gyazo data breach, disclosed by parent company Helpfeel, forced the platform temporarily offline while engineers conducted emergency incident response, revoked compromised access tokens, and implemented preventive maintenance measures.

How the Gyazo Server Vulnerability Was Exploited

On September 11, threat actors identified and targeted a security flaw in Gyazo’s image upload server. Unrestricted file upload vulnerabilities and command injection flaws in media processing pipelines represent one of the most dangerous classes of web service vulnerabilities. In typical cloud media architectures, when an upload server receives image files, it handles them through background processing libraries to execute image resizing, thumbnail generation, Optical Character Recognition (OCR), or EXIF metadata extraction. If an upload endpoint fails to strictly sanitize incoming file structures, enforce strict file-type validation, or isolate execution environments using low-privilege sandboxes, attackers can upload executable scripts or craft malicious media payloads that trigger remote code execution (RCE) inside the processing engine.

In Gyazo’s infrastructure, the server flaw allowed the threat actor to execute arbitrary operating system commands directly on the application host. Once remote code execution was established on September 11, the attackers pivoted to internal network paths and queried backend databases. Helpfeel’s security team detected the unauthorized database activity on September 12 and evicted the attacker from the environment the same day. However, during the roughly 24-hour window of access, the attacker successfully exfiltrated database tables containing millions of user profiles, credential hashes, and media metadata records. Helpfeel subsequently patched the underlying upload vulnerability and placed Gyazo into temporary maintenance mode to contain the incident.

Scope of Exposed Data: Credentials, Tokens, and Metadata

The exfiltrated database contains approximately 23.62 million user records. This dataset encompasses both fully registered accounts and anonymous profiles created without registered email addresses. Based on vendor disclosures, the compromised account information includes:

• Account display names, email addresses, and account password hashes.
• User IDs, device identifiers, profile details, and service usage statistics.
• Active X (formerly Twitter) integration tokens used for direct social media sharing.
• Account billing details and subscription management data.

Helpfeel confirmed that credit card numbers and full payment card details were not stored within the compromised database and were not accessed during the intrusion.

Beyond core user account records, the attacker exfiltrated approximately 490 million image metadata records, predominantly tied to screenshots and recordings uploaded prior to January 2019. This metadata cache contains extensive contextual details about uploaded media, including unique image IDs, upload IP addresses, User-Agent strings, embedded EXIF location data, OCR-extracted text from image contents, image titles, source website URLs, and hashed passphrases used for password-protected media.

Additionally, the attacker obtained a master list identifying private and unlisted images. Because Gyazo relies on unique image IDs within generated URLs to manage access control for unlisted uploads, exposure of the underlying image IDs and metadata allows threat actors to systematically reconstruct valid direct URLs and view confidential media files that users assumed were protected by URL obfuscation.

Blast Radius and Threat Context

The blast radius of this breach extends well beyond basic credential exposure. Gyazo is widely adopted across gaming communities, software engineering organizations, and enterprise IT departments, where users frequently capture screenshots of sensitive dashboards, software code, internal system architectures, personal messages, and financial documentation.

The exposure of OCR-extracted text and EXIF metadata presents a substantial secondary privacy and security risk. Threat actors can easily run automated scripts across the exfiltrated metadata dump to parse sensitive strings—such as hardcoded API keys, internal domain names, personally identifiable information (PII), administrative passwords, and exact GPS coordinates embedded in EXIF data.

Furthermore, the compromise of X integration OAuth tokens creates an immediate risk of account takeover. OAuth access tokens allow third-party integrations to post content and read account data without requiring the user’s primary password. If these tokens remain valid, threat actors can hijack connected X accounts to conduct automated phishing campaigns, post malicious links, or manipulate social media profiles.

Exposed password hashes also present a persistent threat through offline cracking attempts. Given the prevalence of credential reuse across online platforms, attackers will routinely attempt to crack these hashes to facilitate automated credential-stuffing attacks against enterprise single sign-on (SSO) portals, personal email accounts, and financial services.

Remediation and Mitigation Guidance

Helpfeel has remediated the upload server vulnerability, terminated unauthorized database access, temporarily taken the Gyazo service offline for preventive maintenance, and restricted direct file access for media items associated with the exposed metadata records. Helpfeel confirmed that its secondary enterprise services, including the Helpfeel knowledge base platform and Cosense, were hosted separately and remain unaffected.

Organizations and individual users relying on Gyazo should immediately execute the following remediation steps:

• Revoke OAuth Integration Tokens: Users who connected their X (Twitter) accounts to Gyazo must immediately log into their X account security settings, navigate to connected applications, and revoke access for Gyazo to invalidate the leaked tokens.
• Reset Account Credentials: Users should immediately change their Gyazo account passwords and update credentials on any other third-party site or internal service where the same password was reused.
• Audit Uploaded Content: Organizations that used Gyazo to capture or share operational screenshots prior to January 2019 should assume those direct image URLs and underlying metadata are exposed, and revoke or roll any credentials, API keys, or sensitive internal URLs depicted in those captures.
• Monitor Corporate Email Accounts: Security operations teams should monitor authentication logs for corporate email addresses associated with Gyazo accounts for signs of credential-stuffing or targeted spear-phishing attempts.