Gyazo breach: 23.6 million accounts exposed — what was taken and what to do
The screenshot and clip-sharing tool popular with gamers confirmed hackers stole 23.6 million user records via a server flaw. What's exposed and what to do now.
Stated by the maker, publisher, or platform holder.
Gyazo — the screenshot, screen-recording, and image-sharing tool used by a lot of gamers to share clips and captures — has confirmed a data breach affecting 23.6 million user records. If you've ever made a Gyazo account, assume you're in it.
What's confirmed
The exposed data includes:
- Names or nicknames and email addresses
- Hashed passwords
- User and device IDs, and login session IDs
- X (Twitter) integration tokens and Google sign-in email addresses
- Profile details, subscription information, billing status, and usage statistics
Separately, anonymous account records and around 490 million image metadata records were exposed — mostly relating to images uploaded in or before January 2019.
Why this one matters more than a typical breach
Two items on that list stand out.
Login session IDs can, in some cases, let an attacker act as a logged-in user without a password. Gyazo should be invalidating old sessions; logging out and back in is a sensible precaution either way.
X integration tokens are the other concern. If you connected Gyazo to your X account, that token is the permission Gyazo held to act on your behalf. A stolen token is only useful until it's revoked — so revoke it.
The passwords were hashed, which means they weren't stored in plain text. That's better than the worst case, but hashed passwords can still be cracked, especially weak or reused ones.
What to do now
- Change your Gyazo password. If you reused it anywhere else, change it there too.
- Revoke Gyazo's access to X in your X account's connected-apps settings, then reconnect only if you
need it.
- Log out of Gyazo on all devices and log back in.
- Watch for phishing. With names, emails, and subscription details exposed, expect convincing fake
Gyazo emails about billing or account problems. Don't click links in them — go to the site directly.
- Turn on two-factor authentication anywhere you can, starting with any account that shared the
Gyazo password.
The pattern
2026 has been a heavy year for breaches, and a recurring theme is services that sit quietly in the background — tools people signed up for years ago and forgot about. Gyazo is a good example: plenty of affected users won't remember having an account. That's exactly why the fix is worth doing today rather than when a phishing email arrives.