Gyazo Breach: Session IDs, X Tokens and OCR Text From 490M Images

On 16 September 2026, Helpfeel, the company behind the screenshot tool Gyazo, disclosed that a third party had exploited a vulnerability in Gyazo's image upload server on 11 September and accessed its systems. About 23.62 million user records were disclosed, including login session IDs and, for users who had connected X, their X integration tokens. Metadata for about 490 million images was also exposed, including text extracted from screenshots by OCR.

For many companies, Gyazo is shadow IT: a handy tool employees install to share screenshots. That is exactly why this one is worth a look.

What's affected

From Helpfeel's notice and updates:

• Entry point: A vulnerability in Gyazo's image upload server, exploited on 11 September. Helpfeel says it blocked the access routes and remediated the flaw by 12 September. It has not described the flaw further.
• User records, about 23.62 million: Name, email address, password hash, user ID, device ID, login session ID, X integration token (if connected), Google SSO linked email, profile data, language, registration and last login times, subscription plan, billing status and usage statistics. Some records are anonymous accounts with no email.
• Not included: Credit card numbers and other payment method details, per Helpfeel.
• Image metadata, about 490 million records: Mostly images registered on or before January 2019. Fields include image ID, upload source IP, User-Agent, EXIF location data, OCR text, titles, source URLs and hashed passphrases for private images. Metadata for about 2.4 million more images was retrieved using specific filters.
• Private images: A list identifying private images was obtained. Helpfeel says it cannot rule out that some were viewed, and it disabled viewing of some images.
• Tokens and sessions: Helpfeel says it reviewed the authentication data and has "already implemented the necessary measures, including invalidation and restrictions." It does not list which tokens or sessions were invalidated.
• Timeline: Reported to Japan's Personal Information Protection Commission on 15 September. Service suspended for security maintenance on 24 September and resumed on 27 September.

Helpfeel asks all Gyazo users to change their password, and to change it on any other service where they reused it.

How to check if you're exposed

Individual users:

1. Change your Gyazo password, and any reused password elsewhere.
2. If you connected Gyazo to X, open X's settings for connected apps and revoke Gyazo's access if you no longer use the integration. Reconnect later if you need it, which issues a fresh token.
3. Think about what your old screenshots showed. OCR text, titles and source URLs in metadata can reveal internal hostnames, ticket contents or error messages.

Organizations:

1. Find out who uses Gyazo. Search proxy, DNS or secure web gateway logs for Gyazo domains:

# Example against exported DNS or proxy logs
grep -hiE '(^|[.])gyazo\.com' dns-*.log proxy-*.log \
  | awk '{print $1, $3}' | sort | uniq -c | sort -rn | head -50

2. Check endpoint inventory. Look for the Gyazo desktop app and browser extensions in your device management tool.
3. Ask heavy users what they captured. Dashboards, customer records, credentials in terminal windows and admin consoles all end up in screenshots. Uploaded images and their OCR text are now a data source you do not control.
4. Rotate anything that appeared in a screenshot. If a token, password or API key was ever visible in a shared screenshot, rotate it.

What to do now

1. Decide on an approved screenshot tool. Pick one that stores images in your own tenant, enforce it through device management and block unapproved upload services at the proxy.
2. Inventory third-party OAuth connections. Gyazo held X tokens for users who connected them. List which SaaS tools your staff have authorized to act on their corporate accounts, and remove the ones you do not need.
3. Treat session IDs like passwords. If you build a SaaS product, store session tokens hashed where you can, set short lifetimes and make mass invalidation a tested runbook.
4. Minimize stored metadata. Gyazo retained upload IPs, EXIF location and OCR text for years. If your product extracts data from user uploads, ask whether you need to keep it.
5. Add a line to your acceptable use policy. Do not upload screenshots of internal systems to personal accounts on public services.

Why it matters

Small productivity tools often hold more than people expect. Here it was session identifiers, third-party OAuth tokens and searchable text pulled from years of screenshots. None of that is visible to a security team that does not know the tool is in use.

The third-party token angle matters too. When a service you authorize stores a token for another platform, a breach of that service can become access to the other one. Helpfeel says it has invalidated and restricted the authentication data, but revoking unneeded connections yourself is the reliable fix.

Try it yourself

Open your own X, Google or Microsoft account settings and list the third-party apps you have connected. Revoke every one you have not used in the last three months. Then run the DNS log search above for one week of company traffic.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Helpfeel: Notice regarding unauthorized access to Gyazo, 16 September 2026
• BleepingComputer: Gyazo server flaw exploited to steal 23.6 million user records