Security experts have warned that a major data breach at Japanese image-sharing service Gyazo exposed 490 million metadata records related to images, posing significant security and privacy risks to users. The breach, disclosed September 11, also compromised nearly 24 million customer records after attackers exploited a vulnerability in an upload server. The exposed metadata includes image IDs, source IP addresses, user agent information, EXIF location data, OCR text extracted from images, titles, source URLs, and hashed passphrases.
The compromised metadata contains information used to build Gyazo image URLs, which could allow unauthorized third parties to access and view corresponding images, according to Gyazo developer Helpfeel in a September 16 blog post. The company temporarily disabled viewing of some images to prevent further harm. The stolen data is associated with images registered in or before January 2019, meaning most of the exposed information is more than six years old. Helpfeel has urged customers to change their passwords across Gyazo and any other sites sharing the same credentials, though the company noted passwords are hashed to reduce risk exposure.
Michael Bell, founder and CEO at Suzu Labs, said the incident could be particularly damaging for developers and their projects. "Gyazo is a screenshot tool. Developers use it constantly to share what is on their screen, which means those images contain terminal output, API keys, credentials in config files, internal application screenshots, and sensitive documents," he explained. Bell added that the OCR feature that makes captures searchable also extracted and stored all that text, meaning whatever text was visible in those screenshots is now in an attacker's hands as searchable, indexed data. Seemant Sehgal, CEO at BreachLock, argued that "the metadata layer is where the real reach is," noting that EXIF coordinates, OCR-extracted text, session IDs, and image URL construction data give attackers enough to reconstruct user behavior and location history for tens of millions of people.
The breach highlights particular dangers for developers who regularly use screenshot tools to share work in progress. Bell noted that EXIF location data may compound these risks, potentially exposing home addresses, workplace locations, and regularly visited places for users who uploaded a screenshot without considering metadata implications. However, Damian Skeeles, senior solutions engineer manager at Filigran, pointed out that the age of the stolen data reduces the impact of screenshot leaks that could include API keys and other secrets, reinforcing the value of regularly cycling credentials. Paul Bischoff, consumer privacy advocate at Comparitech, warned that email addresses and other identifying information could be used to craft convincing phishing messages, with scammers potentially posing as Gyazo or a related company to trick victims into clicking malicious links.
Helpfeel has remediated the targeted vulnerability as part of its incident response efforts and encouraged users to remain alert for suspicious follow-on emails. Jamie Akhtar, CEO at CyberSmart, said organizations must rigorously patch and test internet-facing services, restrict what upload systems can access, and use continuous monitoring to identify suspicious behavior quickly. Following a breach, companies should invalidate sessions and access tokens, force password resets, and communicate clearly with users, according to Akhtar. The incident underscores how seemingly routine productivity tools can become vectors for widespread exposure when metadata retention policies intersect with inadequate server security. For enterprises relying on third-party sharing platforms, the breach raises questions about whether convenience tools designed for individual workflows carry acceptable institutional risk.