Gyazo Data Breach Exposes 23.6 Million User Records and 490 Million Image Metadata Records

On September 11, 2026, an unauthenticated attacker exploited a missing authorization check on Gyazo’s image‑upload endpoint, gaining direct read access to the application’s PostgreSQL databases. The intrusion resulted in the exfiltration of 23.62 million user records (email addresses and bcrypt password hashes) and 490 million image‑metadata rows, including session IDs, integration tokens, OCR‑extracted text, and private‑image flags. The exposed data enables credential‑stuffing, token‑reuse attacks, phishing, and potential leakage of corporate‑sensitive screenshots, necessitating immediate password resets, token revocation, and metadata encryption.

• Incident Overview

  • Breach detected Sept 11 2026 after anomalous outbound traffic from Gyazo upload server.
  • Approximately 23.62 M user accounts and 490 M image‑metadata records compromised.
  • Affected tables: users (email, password_hash) and image_metadata (ID, timestamp, OCR_text, session_token, integration_token, private_flag).

• Attack Vector & Technical Details

  • Vulnerable /upload endpoint lacked JWT/session validation, allowing unauthenticated POST requests.
  • Compromise of the upload host gave attackers direct SQL access via the application’s DB connection pool.
  • Attackers issued SELECT * FROM users; and SELECT * FROM image_metadata; to harvest data.
  • Session and integration tokens were stored in plaintext; no at‑rest encryption or hashing applied.

• Data Exposed & Impact

  • Exposed fields: email, password_hash, login_session_id, integration_token, OCR‑extracted text, private_image_flag, image_url.
  • ~174 M metadata rows linked images to specific user accounts, increasing targeting precision.
  • Risks: credential stuffing on reused passwords, token replay against linked SaaS services, phishing via harvested emails, exposure of proprietary screenshots, regulatory scrutiny under GDPR/CCPA.

• Indicators of Compromise & Detection Guidance

  • Outbound connections from upload server to unfamiliar IPs on ports 80/443 after Sept 10.
  • Spike in SELECT queries on users and image_metadata tables (>5× baseline).
  • Unknown user‑agent strings (e.g., curl/7.88.0, wget/1.21.4) in server logs during intrusion window.
  • Authentication attempts using leaked password hashes in tools like Hashcat or Hydra against external services.

• Mitigation & Recommendations

  • Force immediate password reset for all Gyazo users; enable MFA where possible.
  • Revoke all active session and integration tokens; issue new tokens post‑reauthentication.
  • Encrypt stored metadata (tokens, OCR text) using AES‑256‑GCM; apply least‑privilege DB roles to upload service.
  • Deploy WAF rules to block anomalous file‑upload payloads and monitor for abnormal DB query volumes.
  • Conduct third‑party penetration testing of upload workflows and audit token handling across all microservices.