Gyazo Breach: 23.6M User Records and 490M Image Metadata Records Exposed — Defender's Response Guide

Helpfeel, the Kyoto-based company behind the Gyazo image-sharing service, published a breach notice on Wednesday confirming that approximately 23.62 million user records — including email addresses and password hashes — were exposed. Separately, roughly 490 million image metadata records were compromised, mostly tied to images uploaded in January 2019 or earlier. Critically, that metadata includes the IDs that make up Gyazo image links.

This is not a routine "email addresses leaked" incident. Two compounding factors raise the stakes for defenders:

1. Password hashes at scale. Until Helpfeel discloses the hashing algorithm and work factor, defenders must assume the hashes are crackable. If Gyazo used a fast, unsalted hash (MD5, SHA-1) or even a weak bcrypt cost, a large percentage of those passwords will be recovered and fed directly into credential stuffing lists targeting corporate identity providers.
2. Image link ID exposure. Gyazo's security model for image privacy relies heavily on unguessable URLs — there is no public index of images. If the IDs embedded in those URLs are now in an attacker's hands, the "unguessable" property collapses for ~490 million images. Screenshots uploaded to Gyazo routinely contain internal hostnames, tickets, customer data, tokens, and credentials captured in error messages. Treat this as a potential secondary data exposure, not just metadata loss.

If your organization uses Gyazo — and many support, engineering, and QA teams do — you need to act this week.

Technical Analysis

What Was Exposed

Affected Platform

• Product: Gyazo image capture/sharing service (web, desktop clients for Windows/macOS/Linux, browser extensions, mobile apps)
• Vendor: Helpfeel Inc. (Kyoto, Japan)
• Scope of metadata exposure: Predominantly images uploaded January 2019 or earlier, per the vendor notice

Why the Metadata Exposure Matters More Than It Appears

Gyazo URLs follow the pattern https://gyazo.com/<image_id>. The service's implicit privacy control is that the ID is a long random token — there is no directory listing, no user profile page enumerating uploads. Security teams have long warned this is "security through obscurity," and this breach demonstrates exactly why: the URL itself is the access control. With the ID corpus exposed, an attacker can iterate the list and retrieve images directly, or cross-reference IDs against timestamps to target specific upload windows.

From an IR perspective, we routinely see Gyazo (and similar tools like Lightshot — which suffered a well-documented enumeration problem) used to screenshot:

• Internal dashboards with hostnames, IPs, and employee names
• Error messages containing API keys, connection strings, and session tokens
• Customer PII in support workflows
• Source code fragments and internal wiki content

If your users uploaded any of the above to Gyazo before 2019, assume that content is now retrievable.

Password Hash Risk Assessment

As of this writing, Helpfeel's notice does not specify the hashing scheme. Your defensive posture should branch on that disclosure:

• If bcrypt/argon2/PBKDF2 with sane parameters: cracking will be slow and targeted; risk concentrates on weak passwords (dictionary + rules still recover 20–40% of typical corporate password corpora).
• If SHA-1/MD5 (salted or not): assume mass recovery. GPU rigs crack unsalted SHA-1 at tens of billions of guesses per second. Credential stuffing waves against Okta, Entra ID, VPN, and email will follow within days of the list circulating.

Either way, the correct assumption is: any password reused from a Gyazo account is compromised.

Exploitation Status

No CVE is associated with this incident — it is a data breach, not a software vulnerability. There is no confirmed public dump at time of writing, but breach data of this size historically surfaces on criminal forums within days to weeks. Monitor Have I Been Pwned for corpus ingestion and treat all Gyazo-linked credentials as exposed effective immediately.

Detection & Response

The realistic threat scenarios following this breach are (a) credential stuffing against your identity provider using recovered Gyazo passwords, and (b) bulk enumeration/retrieval of Gyazo image URLs carrying sensitive screenshots. The detections below target both.

Sigma Rules

The first rule detects password-spray/credential-stuffing patterns at the endpoint level (many failed logons for distinct accounts from a single source). The second detects high-volume enumeration of Gyazo image IDs against web infrastructure if you proxy or log outbound requests — useful for identifying whether someone inside your network is pulling the exposed image corpus, or whether your egress is being used to host retrieved content.

---
title: Credential Stuffing Pattern - Multiple Failed Authentications From Single Source
id: 8f2c1a94-6b3d-4e57-9a01-2c4f7d8e5b6a
status: experimental
description: Detects a high volume of failed logon attempts across multiple distinct accounts originating from a single source IP, consistent with credential stuffing using breached password lists such as the Gyazo corpus.
references:
  - https://attack.mitre.org/techniques/T1110/004/
  - https://thehackernews.com/2026/09/gyazo-breach-exposes-2362-million-user.html
author: Security Arsenal
date: 2026/09/25
tags:
  - attack.credential_access
  - attack.t1110.004
logsource:
  category: authentication
  product: windows
detection:
  selection:
    Outcome: failure
  condition: selection | count(Account) by SourceAddress > 15
timeframe: 10m
falsepositives:
  - Misconfigured service accounts retrying authentication
  - Legacy applications with cached stale credentials
level: high
---
title: Bulk Gyazo Image ID Enumeration via Web Infrastructure
id: 3d7e5b21-9a4c-4f18-b6d2-1e8a3c9f5d47
status: experimental
description: Detects sequential or high-volume requests to distinct gyazo.com image IDs from a single client, consistent with enumeration of the 490M exposed image metadata records.
references:
  - https://attack.mitre.org/techniques/T1595/002/
  - https://thehackernews.com/2026/09/gyazo-breach-exposes-2362-million-user.html
author: Security Arsenal
date: 2026/09/25
tags:
  - attack.reconnaissance
  - attack.t1595.002
logsource:
  category: webserver
detection:
  selection:
    cs-host|contains: 'gyazo.com'
  condition: selection | count(cs-uri) by c-ip > 50
timeframe: 15m
falsepositives:
  - CDN/cache nodes serving embedded images on high-traffic pages
  - Corporate proxy aggregating multiple users behind one egress IP
level: medium

KQL — Microsoft Sentinel / Defender

This hunt looks for credential stuffing signatures in Entra ID sign-in telemetry: a single source IP generating failures across many distinct accounts, with any successful sign-ins surfaced for immediate triage. Run it over the past 7 days, then extend to 30 once the Gyazo corpus inevitably circulates.

// Credential stuffing hunt: many failed sign-ins per source IP, flag any successes
let Lookback = 7d;
let FailureThreshold = 20;
SigninLogs
| where TimeGenerated >= ago(Lookback)
| where ResultType != 0
| summarize
    FailedAttempts = count(),
    DistinctAccounts = dcount(UserPrincipalName),
    Accounts = make_set(UserPrincipalName, 25),
    Apps = make_set(AppDisplayName, 10)
  by IPAddress
| where DistinctAccounts >= 5 and FailedAttempts >= FailureThreshold
| join kind=leftouter (
    SigninLogs
    | where TimeGenerated >= ago(Lookback)
    | where ResultType == 0
    | summarize Successes = count(), SuccessfulAccounts = make_set(UserPrincipalName, 10) by IPAddress
) on IPAddress
| extend RiskFlag = iff(Successes > 0, "SUCCESSFUL SIGN-IN FROM STUFFING SOURCE - INVESTIGATE", "Failures only")
| project IPAddress, FailedAttempts, DistinctAccounts, Successes, RiskFlag, SuccessfulAccounts, Accounts, Apps
| order by Successes desc, FailedAttempts desc;

// Supplementary: outbound connections to gyazo.com from Defender endpoints - scope image exposure review
DeviceNetworkEvents
| where TimeGenerated >= ago(7d)
| where RemoteUrl has "gyazo.com"
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
  by DeviceName, InitiatingProcessAccountName, RemoteUrl
| order by ConnectionCount desc;

The second query inventories which endpoints and users are actively reaching Gyazo — this scopes your exposure review (who uploads screenshots) and identifies any anomalous bulk retrieval patterns from corporate hosts.

Velociraptor VQL

If you suspect credential stuffing tooling (e.g., OpenBullet-class configs loaded with combo lists derived from the breach) is being run from a managed endpoint — or you need to scope which local users have Gyazo clients installed for forced credential rotation — this artifact hunts both.

-- Hunt for credential stuffing tooling and Gyazo client footprint on endpoints
-- Part 1: Processes matching known stuffing tool patterns or bulk-list CLI usage
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(combo|wordlist|proxies\.txt|hits\.txt|openbullet|silverbullet|storm|snipr)'
   OR Exe =~ '(?i)(openbullet|silverbullet|snipr)'

-- Part 2: Gyazo client installations (scope credential rotation blast radius)
SELECT FullPath, Size, Mtime
FROM glob(globs='C:/Users/*/AppData/**/Gyazo*/**')
ORDER BY Mtime DESC
LIMIT 100

Remediation

Immediate (24–48 hours)

1. Inventory Gyazo usage. Use the KQL above, proxy logs, and software inventory to identify users with Gyazo accounts registered on corporate email addresses.
2. Force password resets for any account that reused a Gyazo password. Since you cannot verify reuse directly, the pragmatic control is screening: enable banned-password / breached-password protection (Entra ID Password Protection, or equivalent) and force resets for flagged accounts.
3. Enforce MFA everywhere the identity touches. Credential stuffing is defeated by MFA on the IdP, VPN, email, and remote access paths. Verify no legacy protocols (IMAP/POP/basic auth) bypass MFA.
4. Alert users to targeted phishing. 23.6M verified emails tied to a specific service are premium phishing bait. Expect Gyazo-themed "reset your password" lures harvesting the new passwords.

The following PowerShell script audits Entra ID (via Microsoft Graph) for users with password-protection-flagged risk and stale MFA registration, and generates the enforcement list:

# Requires: Microsoft.Graph PowerShell SDK (Install-Module Microsoft.Graph -Scope CurrentUser)
# Run as an account with User.Read.All and Policy.Read.All

Connect-MgGraph -Scopes "User.Read.All","Policy.Read.All","Directory.Read.All" -NoWelcome

# Pull all enabled cloud/hybrid users and check MFA registration status
$Users = Get-MgUser -All -Property "id,userPrincipalName,accountEnabled,createdDateTime" `
  | Where-Object { $_.AccountEnabled -eq $true }

$Report = foreach ($U in $Users) {
    $Mfa = Get-MgUserAuthenticationMethod -UserId $U.Id -ErrorAction SilentlyContinue
    $StrongMfa = $Mfa | Where-Object {
        $_.AdditionalProperties.'@odata.type' -match 'microsoftAuthenticator|phoneAuthentication|fido2|windowsHello'
    }
    [PSCustomObject]@{
        UserPrincipalName = $U.UserPrincipalName
        StrongMfaRegistered = [bool]$StrongMfa
        Action = if (-not $StrongMfa) { "Enroll MFA + Force Password Reset" } else { "Force Password Reset Only" }
    }
}

$Report | Where-Object { -not $_.StrongMfaRegistered } |
  Export-Csv -Path ".\Gyazo-Breach-MFA-Gap-$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation

Write-Host "$($Report.Count) users audited. Gap report exported. Force resets via bulk password reset or Conditional Access grant controls." -ForegroundColor Yellow

Image Exposure Remediation

• Treat pre-2019 Gyazo uploads as public. Gyazo allows users to delete images — instruct users to delete any screenshot containing internal data, credentials, hostnames, or customer information. Deletion removes server-side copies even if the link ID is known.
• Rotate anything ever screenshotted. API keys, tokens, or connection strings visible in historical Gyazo screenshots must be rotated. Check your secrets management inventory against teams known to use Gyazo heavily (support, QA, engineering).
• Move to a governed alternative. If screenshot sharing is a workflow requirement, migrate to a solution with real access control (authenticated viewers, org-scoped sharing, DLP integration) rather than unguessable URLs.
• Request vendor specifics. Ask Helpfeel directly: hashing algorithm and parameters, whether salts were per-user, breach vector, and timeline. These answers determine whether your reset campaign is precautionary or urgent.

Ongoing (30 days)

• Subscribe to Have I Been Pwned domain notifications; validate when the Gyazo corpus is ingested and re-run the credential stuffing KQL against that date forward.
• Deploy the Sigma rules above to your SIEM and tune the thresholds against your baseline.
• Add Gyazo link-sharing to your DLP and acceptable-use policy — screenshots leaving the perimeter are a chronic, low-visibility exfiltration channel.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub