Gyazo, an app that turns every screenshot into a shareable link, was breached. A threat actor reached its database and took 23.6 million user records plus metadata for 490 million images.

That metadata includes the image IDs those links are built from, along with upload IP addresses, EXIF location data and text the service had extracted from the screenshots with OCR.

Helpfeel, which operates Gyazo, says the intruders also took a list identifying which images users had marked private, and it cannot rule out that some were viewed.

Gyazo is offline, files tied to the exposed records are blocked, and users are told to change their password anywhere they reused it.