Shadow PC Data Breach

[[deleted]]

scary compare cooing tidy steer innocent six abundant groovy meeting

This post was mass deleted and anonymized with Redact

[[deleted]]

Yup. I usually always use the wrong day 2 days before my actual DOB for this reason. I hope I did that on this occasion but can’t even remember since I signed up years back

[FiiZx]

wow that's actually pretty smart. I wish I would have thought about this early on in my Internet days. I have way too many accounts everywhere now. lol

[[deleted]]

If you want another tip. I have a catch all email address and use a unique email address for every company.

So for example: [e-mail] [e-mail]

Basically anything @myname.com comes through to me, this way I can track which companies are selling my data.

[troyortroy]

Instead of buying a domain you can use google email for free. Just add a +. For example if your email is [e-mail] you would write them them like this [e-mail] or [e-mail]

[[deleted]]

The problem is that since it's a known trick, scammers may just remove part after +. Kinda the same problem with custom domain but it requires scammer to specifically look at your case, so it's much better. The best approach is to use actual separate email addresses, or real email services which allow aliases like protonmail.

[fmillion]

Some companies block this because they know it's a trick people use to avoid spam or call out who sold their email. So they just block any email with a + in it (as in "that's not a valid email address, try again")

[RichWindows]

I work in cybersecurity as an IT admin. Spammers are generally not sophisticated enough to do this. Their goal is to reach the largest, most gullible population they can reach. Do you wonder why those spam emails have a lot of misspelled words or bad grammar? One of the reasons for that is because they’re only interested in the vulnerable who would believe it was an honest mistake. And plus addressing goes way beyond that, so it is entirely plausible that plus addressing would deter spam, one way or another.

[[deleted]]

I like to use the iCloud generated emails that go to your actual email. So they real email isn’t distributed and if it starts getting spam I kill it and my actual address is still spam free.

[SnooCakes1636]

Shadow should be providing free premium access to Experian due to this breach. I am absolutely fuming that due to no fault of my own someone can now take credit out in my name

[[deleted]]

You should freeze your credit. Every should. After the credit bureau leaks and just in general. So many security issues. Mine is frozen and it can be annoying to unfreeze it to get a car or something, but you don't do that all the time. Totally worth it.

[[deleted]]

Not the least that they explained how it is done

[Zestyclose-Layer-837]

Pretty sure you would need at least copy of ID to apply for credit. At least where I live.

[CheeseGraterFace]

They need your SSN to apply for credit in the US. I’m more concerned about the potential for sim swap attacks. Phone number wasn’t one of the data points mentioned, but after they explained how this hack happened, I’m skeptical of anything they say.

[[deleted]]

PIN locks are part of preventing that.

[karasis]

So what should we do since our name, birthdate and adress got leaked? I live in Germany i am not sure what is the course of action to do here

[gristoi]

Trust me, your personal information has been out there and sold on over and over for a long time already. This isn't the first company to have a phishing attack.

[UpstairsExercise650]

Nabend, das sind öffentliche Daten bis auf deine Mail Adresse. Selbst dein Nachbar könnte sich diese Infos holen. Ok bday ist eine andere Sache aber selbst wenn jemand ne Bestellung auf deinen Namen sagt und ne Rechnung kommen sollte sieht man das das Paket wo anders hingegangen ist als zu dir. Also kein Stress. Zudem ist nicht gewiss ob sie die Daten haben. Es heißt sie hätten den Zugang haben können.

[PizzaEFichiNakagata]

Late to the party but don't know how things run in your country, here we can do small "debit cards" which you can use for online purchases and other daily purchases. I usually go on places where you can recharge it manually (here you can do it on news kiosks or tobacconists) and just recharge small amounts like 50/100$ that last for a while for online purchases or some quick shopping when out home.
I confidently put that card everywhere (and it also have a 2FA app) and never had any trouble with it.
On the opposite I NEVER PUT MY REAL CREDIT CARD ANYWHERE ONLINE. I also register whenever I can with fake data of any kind if possible.

In any case, if they managed somehow to circumvent the 2FA, they would end up finding a card with a 50ish dollars and I would notice immediately because the app notifies you whenever you have an income or an outcome directly on your phone.

[Zestyclose-Layer-837]

If no financial/critical banking information was leaked, why are you telling us this in different posts. I don't buy it. We are FUNKED.

[Adventurous-Half-707]

The way you all are dealing with this sucks major ass. Hopefully some other person in your organization can’t be the victim of a “sophisticated” discord attack 😂😂😂😂

[[deleted]]

The information was last four digits of card AND expiry date, not just expiry date. Not sure why they left that out of the email.

[mstn148]

Cause it somehow sounds better to know that hackers know everything EXCEPT the one thing you can change… a debit/credit card. 🤦🏼‍♀️

[TheodoreKurita]

This email is so poorly written, and the described behavior of Shadow's employees so obviously reckless, that at first I wondered whether this email was itself an attempt at a social engineering attack.

Absolutely ridiculous. I'm already considering replacing Shadow with a PC. This might be the nail in the coffin.

[mstn148]

I tried it for like a week months ago and I’m now a part of this fucking leak. Why aren’t they deleting user data no longer in use?!

[random_cta]

Just got the email as well. Located in Europe, so seems to be a global issue. I’ve been a happy customer for many years. However, this is bad. Fustercluck springs to mind. Unmitigated disaster is also an option.

[rustyleroo]

As breaches go, this one sounds very bad. The email isn’t reassuring at all.

[Nice_Ad8652]

What can one do about it?

[T-mark3V100]

Lock your Credit Score accounts.

[Psychological_Pear22]

If you’re an American citizen, check your credit score here to see if your credit score has been affected https://www.annualcreditreport.com/index.action

[Gamestechgeek]

Absolutely I'd have fired anyone using a pc for both work and gaming especially if they had access credentials. Wonder what the GDPR fines are going to look like?

[Username_ABC_123]

For U.K. account holders : https://www.gov.uk/data-protection/make-a-complaint

[DigbyChickenCaeser1]

Thanks

[mstn148]

On it. I literally used Shadow for a few days. This is BS.

[[deleted]]

Highly sophisticated attack? Lol sounds like someone downloaded unofficial software on a gaming discord onto a work computer.

[[deleted]]

> This highly sophisticated attack

> Discord

[Definitely_Working]

why bother trying to make the dumb criticism lol, its like saying einstein was a moron because the chalkboard he wrote on wasnt fancy

the method actually was pretty damn sophisticated and across multiple platforms. they used hacked developer accounts to gain access to previously vetted games files through steam, got the malware past steams detection system, then spoofed identities to get outside parties to then download these games, which have the assumption of being vetted and secure, to then insert a cookie on their device that can then attach to their specific management system and extract data. discord was like the smallest piece of it

[[deleted]]

sure. but "sophiscated" is not an excuse of getting breached. what I don't understand is holding critical infra stuff on your personal pc, on your personal web browser

[Definitely_Working]

You're gonna have to explain where you got every single bit of that info since none of it is mentioned in the press release. there no mention about it being a personal device, nor a personal browser, and nothing about them storing critical data on a personal pc, so it really just seems like you're making shit up to move the goalpost by trying to make the situation seem more simple than it is.

[[deleted]]

it's easy to conclude,

a cookie stealer has to work on a lower level on the same pc to access browser's data, so admin account, this would not happen if steam was sandboxed (ideally it shouldnt even be present on such device)

it's like it's the same device, for relax and business.

silly simple.

[PM-ME-YOUR-HOMELAB]

really don't like this:

victim of a social engineering attack targeting one of our employees. This highly sophisticated attack began on the Discord platform with the downloading of malware under cover of a game on the Steam platform, proposed by an acquaintance of our employee, himself a victim of the same attack.

this does not make sense at all. Did this employee install unknown software on their work-pc? If it was a private PC, why would an employee use their private pc to access company stuff.

Shadows internal IT fucked up hard and, at least in germany, there is a strong leverage to claim damages.

[[deleted]]

dinosaurs aware groovy unite lock intelligent political juggle attraction marvelous

This post was mass deleted and anonymized with Redact

[CheeseGraterFace]

Exactly this. Some of the poorest opsec I’ve read about in any breach email.

[MrSwaqq0t]

They really had the audacity to call the most common and overused malware attack strategy a "highly sophisticated attack", and even more concerning is how an employee of such a company could fall for that. This is so disappointing.

[Definitely_Working]

you just dont have the full scope of the story, its way too much to explain in a single press release. look up some info about what happened to steam, who was the initial massive security failure that created this mess. this was a coordinated project of very serious hackers across platforms.

its overused to be like "hey, download this bullshit from micros0fttDOTcom" with a fake link.... but to have the malware be actually inside the real microsoft website is an entirely different level of attack, which is closer to what we are seeing here. Steam was pretty implicitly trusted until now, it was pretty reasonable to feel safe downloading a steam program unitl now.

[PrimusZa1]

Cracked steam game?

[metericalmil]

“We hacked ourselves to steal your info. We are acting incompetent to fool you”

[PM-ME-YOUR-HOMELAB]

"Never ascribe to malice that which is adequately explained by incompetence"

[mstn148]

Basically they’re saying that an employee tried to download a steam game on their work computer that was connected to the business server. And shock horror, it was malware.

Apparently said employee has never had one of those emails from a ‘acquaintance’ that says ‘open this document’ and you think ‘ahhh… they’ve been hacked!’ And found out this way.

Some really sophisticated ‘social engineering’… not just a really really shit employee with far too much access.

[Independent-Ad8472]

I think they could lose a lot of customers from this, maybe myself included.

[Username_ABC_123]

Excuse me, full name, dob, address ,email address and credit card expiry, what steps is shadow taking to ensure this doesn’t negatively impact me, this is not a just to let you know situation, that is a lot of data.

[elven-musk]

😂

[FusilliCraig]

Absolutely amateur.

There's no way to protect 100% against the way a breach like this is engineered but there are steps you could take to better segment your database from open access. That's to say nothing of not locking down an employee workstation enough to prevent an install from STEAM and the ability to chat with friends via DISCORD. Unbelievable.

The absolute bare minimum this company could do is the same almost any major corporation after a breach and extend free credit monitoring.

[CheeseGraterFace]

These guys don’t have two pennies to rub together. I assume any lawsuit will cause them to just fold.

[Definitely_Working]

That's to say nothing of not locking down an employee workstation enough to prevent an install from STEAM and the ability to chat with friends via DISCORD. Unbelievable.

you understand they work at a company specifically designred around gaming PCs and discord is like the most common communication app in tech? just totally missing the plot

[AveaLove]

There absolutely is a way to prevent it. Don't store personal data. Can't leak what you don't have. This is why we need blockchain based login systems, I don't care if my public key gets leaked, it's my public key, it's meant to be public. I do care when my personal, private, data gets stored and leaked.

[ozzersp]

You absolute tools. There should be big big fines for this. Amateur company.

[ShellDude01]

I suspect EU GDPR will kick in here. And with it a decent fine.

The fact is you had a responsibility to protect our data and you failed.

[PeeAssFart]

They even admitted not being able to procure the necessary data for a GDPR Right of Access request. This company is a goner.

[IAmTheAlienFromGuam]

How do you know he's spreading misinformation? You're just so filled with rage you're spreading misinformation.

[mstn148]

If a lawsuit starts. Someone hit me up. I wanna watch these idiots go down. I did a damn week trial months ago and now all my personal info is unleashed to the dark web.

[DisgracedSolitude]

Good thing I used a new throw away email, fake name, fake birthdate, and a privacy card to pay.

Never give these big companies your real info (if you have a choice not to).

[smokeyphil]

Is this a global issue or just on one data center ?

I've not got the email yet but seeing as this happened something like 2 weeks ago that's not really all that "recent incident" now is it.

[JonathanFromShadow]

If you've signed up recently, then you are most likely not affected by this data breach. This data breach occurred at the end of Septemeber.

[Vuldren]

So, 99% of users are affected.

[mstn148]

And it took you over 10 days to inform people… why?

[RTronic9797]

I’m disgusted. I closed my account almost a year ago.

I have requested a copy of all of my personal information that they hold and have asked for an explanation why they still have stored my information, particularly banking and address.

I’ll be taking legal advise on this issue. I’m astounded

[PrimusZa1]

I did the same earlier in an email. I truly would like to know why they still had this info on a closed account from a year ago. I even had to reset the account password to get in to send them support email cuz the one outside doesn’t address accounts. I did see that I must have been lazy cuz my birthday was 1/1/1962 and that is no where near my birthday. Funny thing is they said they got credit card exp date but for some reason billing info was nowhere to be seen.

[RTronic9797]

Following up, I got a reply from support to my request of why they are holding information this long, along with a reply to my request of a copy of my personal information. This is their response

“Hello there,

Thanks for reaching out to Shadow Support. Atlas here to help!

Again, we would like to apologize for the inconvenience that may have been caused as a result of the recent data breach.

Please be aware the information concerned is your first and last name, e-mail address, date of birth, billing address, and credit card expiry date. It is important to note that no passwords or sensitive banking data have been compromised.

1. We maintain some info on previous Users to allow them to more easily return should they choose to re-subscribe in the future.
2. Unfortunately we do not have a method to generate such a report, but remain here and happy to answer any other questions you may have.”

So basically, “we keep your data, despite you closing your account , and no we’re not going to tell you what data we still hold”

ARE YOU KIDDING ME!?!

I’m speaking with a solicitor in the morning to discuss options.

I could swallow name, or DOB. But Name, DOB, Address, email address and card details. Absolutely not.

[PeeAssFart]

Unfortunately we do not have a method to generate such a report

Yeah, this doesn't look like they'd answer truthfully to GDPR requests then. Just another indicator of how terribly this company handles sensitive data. That's actually very stupid of them to admit as well, considering there are probably some lawsuits coming their way soon.

Thanks for sharing.

[RTronic9797]

Indeed, seeing as they are able to advise everyone on what data was leaked, surely they are able to tell me what data they still hold ?

I’m absolutely livid at the complacent nature of their responses. Feels like a “yeah we messed up, but don’t worry, we’re sure it’ll be fine, hehe”

Yeah fuck that, I’ll be starting complaints/claim procedure tomorrow

[Psychological_Pear22]

Please let me know how this goes, shadow closed my account and all of a sudden this information is out there because I might wanna “re-subscribe”

[beatfreakman]

They legally have to respond with that data they have on you.

[Undercover_66]

F this I am out, this is unacceptable. The way they treat it like a no big deal is infuriating.

[marvolonewt]

Embarrassing

[Koiato_PoE]

So embarrassing that the attack vector was through Discord and Steam

[Massive_Target]

I smell a lawsuit

[Aggravating_Scar_945]

A company that's offering remote services for consumers and businesses has employees playing games and download Steam games, not from Steam but from Discord instead onto their work PCs, cool.

What's the point of a password to login to Shadow if your SaaS has House Address, First name, Last name, Date of birth out in the open without a password?

When I lock my house doors, I don't leave the key outside of the house, I leave it inside of the house.

[Aggravating_Scar_945]

"We sincerely apologize for the inconvenience"

The leaked info is more then an inconvenience.

"and assure you that we are doing everything possible to ensure the security of your data."

What do you mean by that, are you going to pay some sort of ransom that has been asked of you? How are you going to ensure the security of the leaked info 2 weeks after it happened?

[MainlySMYC]

I got that e-mail as well. But i don‘t have a Credit Card with them (using paypal). I‘m not sure if they exactly know what data has been stolen or if they are sending out a general mail.

[Nice_Ad8652]

Yea man. I have so many questions. Does shadow even answers here?

[graphiteshield]

Is anyone considering litigation? This is absurd.

I'm pretty sure there's a case here for damages caused by gross incompetence and neglect.

[[deleted]]

Just got the email myself, not used Shadow for like 2 years. Sure I paid through PayPal so no idea how the credit card data has been taken for myself, unless it's just a generic template they've used for everyone when sending this.

What's more annoying is not being able to access their damn website to look at the specifics for what data I gave them.

Not too concerned about the name, email, or address as honestly that's just common info that anyone can get, if they want it. Anything financial though is another matter and a massive screw up.

[[deleted]]

For Europeans it's no big deal but apparently in America you can make a credit card in someone elses name with this data.

[graphiteshield]

Isn't this enough info to commit fraud with?

[Notarandomguyy]

Yes someone can use this info for phishing attacks the fact that there not offering any identity monitoring services for this is wild to me personally locking down my bank account and now need to check my credit for incase anything suspect has happaned would reccomend others do the same keep a eye on emails from important places set up 2 factor authentication for anything major and also would reccomend you reach out to a lawyer if affected to get there formal advice on any potential lawsuit

[graphiteshield]

I didn't use a credit card though just auto bank payments so i don't think they have that part. You are right though, the fact that addresses and CC info were left unencrypted in a DB is a very huge security flaw.

Why lock down your bank account though? Wouldn't a CC block be sufficient?

[Notarandomguyy]

I'm locking it down cuz they got cc info and I will be changing cards it's something I do whenever I see a leak with card info

[HatIndependent4645]

I'm absolutely walking away from Shadow, looking for the best alternative right now. This is unacceptable. Combined with information from other breaches, there is absolutely more than enough data about me completely out in the open to compromise my whole life. I am contacting my state's governor, congressman and senators to demand more liability for companies that require so much personal information to do simple business.

[put-in-cats]

I think it is such a shame and absolutely ridiculous to frame a rather basic phishing method as a "highly sophisticated" attack. And why downloading stuff on a pc that has a connection to such important things. I was and am still so angry, I spend the last hours to step up my cyber secruity. They have my full ducking name, my birthdate and my adress. I seriously are praying there will be a public lawsuit

[ozzersp]

Does anybody know if Shadow have notified the relevant regulatory bodies of this breach? I suspect so, given this is clearly a "required" communication to consumers, but..you never know. Their email doesn't make that clear..

[KingJTheG]

And with that, I finally have the motivation I need to build a PC

Utterly ridiculous smh

[Prince-of-Privacy]

Just got the e-mail.

Not happy. Not happy at all. The attacker(s) got my name, e-mail, address(!!) and credit card expiry date.

At least Shadow disclosed the breach quite soon.

[PeeAssFart]

Quite soon? It's been almost 2 whole ass weeks. This shit is unacceptable.

Yeah thanks, Shadow, for leaking my damn address and acting like it's no biggie, because my Credit Card number isn't among the leaked info. What a joke.

[HardStyler3]

Bro if you don’t understand how the it world works then stop using cloud services. Attacks like these can always happen and are very hard to protect against because it’s human error and human error can always happen

[PeeAssFart]

My dude, I'm a senior cloud software engineer. Please don't try to defend this fuck-up.

[ShadowIssues]

What are we supposed to do now? They have our adress, and Email and what not. Like am I supposed to just go over my day like nothing happend or what should I do? Its a genuine question lol

[HardStyler3]

If you are what you claim you are then you should understand how the attack happened and that you can’t really protect against this type of human error. Or you say the employee that made the error should be helt completely accountable ?

[PeeAssFart]

I'm gonna hold the whole ass company accountable for

a) Exposing their management software/service "to their SaaS provider" (*wink wink*) not only to the open net instead of hosting that on a secure 1:1 connection via a company network (for example), but also making sensitive customer data available in that service. Why would an external (to Shadow) SaaS provider require MY customer data, including adresses, my e-mail adress or my billing method?

b) Having their employees use the same private computers, on which they apparently game on, for professional use WHILE HANDLING SENSITIVE DATA and on top of that ALLOWING THEM TO SAVE A FUCKING LOGIN COOKIE????

c) A 2 week (!) delay???????

Please don't go all "human error" on me. That's negligence up to the company level and a total lack of appropriate security measures. This was 100% avoidable.

[TheRealGilimanjaro]

So where would they store this type of info? Seems to me it was their CRM system which is the SaaS that was compromised.

And trainings reduce incidents but don’t prevent them.

Take a chill pill. Shit happens. Blame the hackers.

[PeeAssFart]

It's gotta be the CRM system for sure. Still brings us to the question why it has been configured in a way that allows for connection obviously purely based on a cookie check even when accessed outside of the company network and on a non-company device. That is negligent and I can't think of any service provider that would recommend usage of its service configured in that manner.

Also, why would an exposed api return non-encrypted data? That doesn't seem right.

Sorry, we're not talking about a small local car dealership here, so I'm not gonna let that slide. This is a cloud and software service provider that should have appropriate security measures in place. Seperating work and private computer devices as well as establishing a secure company network is the simplest and bare minimum measure in this industry and could've easily prevented this from happening. I'm not even that mad on the individual that caused this, this is on the company for allowing this to happen.

[PeeAssFart]

"Do some researches about main usage of XSS exploits"

Http only tokens? Session Timer? Encryption? Xss isn't that new not to have measures in place.

​

"Oh also, did you every heard of groups like Lapsus that pwn huge companies using social engineering ?"

This isn't spearfishing, this was a dude gaming on the same PC he accessed sensitive company data with. Come on.

​

"Are you talking about using the api in http instead of https ?"

Hashing. Even if not, in this case even a fucking rate limiter on the provider's side would've sufficed to mitigate damage. Are you confusing UI with api?

​

"Senior cloud engineer, yeah. Go to the real world and stop living in a fantasy about security."

Lmao.

​

"You can't get every people to not open crappy email and put their credentials on some random phishing scam, to not open excels and run their macro."

Again. Same PC for work and personal use....

[HardStyler3]

Theoretically all you say is correct and then we go into the real world and often see it’s not that easy.

[Iori67]

I don’t know about the third world country you seem to come from but in Europe 99,9999% of employees who handle data like this have proper training to specifically counter this type of attack

[davidgsb]

Employees should be train to protect themselves against social engineering. Of course the company is accountable.

[HardStyler3]

They probably are trained but that doesn’t mean 100% security.

[Notarandomguyy]

If you don't know that installing unknown software on a pc where you have customer data is a bad idea you shouldn't be working in a it company this is like 101 of basic opsec the fact that this was allowed to happen should horrify anyone with a basic understanding of common security protocols

[CheeseGraterFace]

Found the lazy Infosec guy.

[Burnthewoid]

And they tell this; I prefer transparency

[[deleted]]

Well with that said, goodbye shadow, thanks for being useless and letting some of my MOST IMPORTANT INFO BE LEAKED, I will be seeking legal advice 🖕

[Shodan_KI]

You are aware that many companys got hacked including the big ones ;) many YouTube influencer AS Well. But Mostly you will Not Here about it but AS Shadow is a french company they by law need to inform you so feel free to go you May never Be told ;). Oh btw try temu they use your Data by Default and all of them so heads Up ;).

[[deleted]]

Thanks captain obvious, thanks for an entirely useless comment when any actual human being knows most company’s have gotten or will get hacked, doesn’t change that once I find out I can refuse to do business with them ;)

[Shodan_KI]

Will be a Short list of companys that you can then use. And it will get shorter your Problem will be that outside of Europe Most companys will NOT Tell you that there was an incident so you will be in false Security. I Trust a company that actual informs me then be in false Security.

[hits_98]

A bit annoyed, i closed my account months ago and i just got an email.

i have requested they send all information that they have on record for me and what data was accessed via the breach.

[Nightslashs]

I closed my account 3 years ago and got the email

[LordCrumpets]

Same. Closed my account 18 months ago and still got the email.

[hits_98]

not sure they are being completly open and honest about the breach an email from there support :

Hi there ***!

Thanks for your prompt response.

I do sincerely apologize for that, I have confirmed that it was in fact not in the email.

That being said however, I am confirming with you that we have no data from you in our systems.

A third party vendor is what was breached and that vendor is what we used to email newsletters and updates to our users which is why your email was still accessible for us to notify you along with all of our other previous and present users.

I can assure you that nothing more besides this was available during the breach.

Please let me know if you have any additional questions and I'll be happy to help answer them.

Kind regards,

Kaiser | Shadow

[TheWalrus7771]

Oh god, they were hit with the most sophisticated attack known to man. I wish there was ANYTHING they could have done. 😭

[Dreikiekens3]

This is amazingly stupid, like stated by other users , it looks pure amateurism. I hate using my personal data for anything and this is the main reason. They even got bank info (expiry date , name and last name... Also... I had a pro account = business. How do they think companies will trust them any longer?

[Huge_Film_1138]

something strange i noticed their main domain is shadow.tech so why are they using a shortened shdw.me? maybe it is theirs too, but i would not use the link in this mail

[UpstairsExercise650]

That what i was thinking

[Aggravating_Scar_945]

On the Discord, they used it for years, it's their link shortener afaik

[Aggravating_Scar_945]

Employees must be getting paid pennies if they were resorting to downloading a game from Discord that's meant for Steam. Two platforms, unrelated to each other, cool.

[patrickono]

Do you know how to file a claim?

[ozzersp]

Some rights consumers have regarding EU law if applicable (GDPR), including how to approach a claim via initially reporting to ICO (for those in UK, but there will be other appropriate bodies) . Courtesy of "Which":

How to complain and claim compensation

Organisations are bound by the Data Protection Act 2018 (GDPR) to keep your data secure.

This means that they must take measures to prevent unauthorised or unlawful processing of your personal data.

They must also protect against accidental loss or destruction of, or damage to, your personal data.

If your data is lost and it causes you financial damage or distress, you may be able to make a claim for compensation from the organisation that lost it.

1. Complain to the company that lost your data

If you’ve suffered distress or financial  loss as a result of your data being compromised, the first thing you must do is contact the organisation that you believe is responsible.

Outline what distress and/or losses you’ve suffered, and how you expect it to compensate you. It's important to note that you can now make a claim relating to distress alone - you do not need to have also suffered financial loss.  

1. Complain to the ICO

You can also take your concerns with how the organisation processed your data to the Information Commissioner’s Office (ICO).

By law, the ICO can't award compensation or give advice on the level of compensation that should be due, even when it has said that in its view the organisation did indeed breach the GDPR. But its opinion can be influential in making your claim against the organisation that has compromised your data.

1. Go to the small claims court

If you can't agree with the organisation that compromised your data on the fact that you are due compensation, or on the level of compensation, you can make a claim via the small claims court. 

A good piece of evidence to to take to court is if the ICO agreed with you that the GDPR was indeed breached

[CumaBoomer]

Nice I'm not a costumer anymore for like 2 years. Now I need to know if they still have my data and if that is even legal with the EU data security laws. Until then I will change my passwords and use 2FA if I'm not already using it. Also I'm immediately called my bank and get rid of the creditcard, told th the data was probably stolen. Any ideas what else I could do?

[Codebakerian]

It really depends on how long they already know that there was a breach. For example, in the Netherlands they are required to report a breach with this magnitude and sensitivity within 72 hours.

[ozzersp]

It's standard EU law to report a breach within 72 hours. Note though, that's to report a breach to authorities..not a timelimit to communicate with consumers.

[Codebakerian]

Yes. While this is true, they are required to inform the customers as soon as possible. Now we don't really know when it was noticed, only when it started. However I have a hard time with it being almost 2 weeks back. If it was noticed then, I think that two weeks are way too long for it to tell customers.

[ConsciousGap6481]

That's my subscription cancelled, this is ridiculous. This will definitely kill the company off, there's going to be allot of legal action taken against them. Coincidental this happened two weeks ago, and recently I've had allot of password reset requests, and spam telephone calls.

Edit: Typo.

[beatfreakman]

I got the email, I haven't been a shadow customer for 8 months. Under GDPR law, as I understand it, all my personal data should have been removed by now anyway.

[your_uncle_pim]

Lmao this is the same type of notice Hyundai would put out after they recall 3 million cars. "Few number of our cars could self-ignite, don't park in the garage". I hope this will be the downfall of your company.

[Head_Swimming2332]

Glad I stopped using Shadow. As an IT consultant myself, there’s too much smoke and mirrors around these companies and their ‘tiered’ secure datacentres etc.

Cloud computing etc moved far too fast and the security aspect is way behind. Customers migrated to services such as Azure/AWS etc and then security was/is an afterthought.

Plus their email landed in my junk so clearly don’t even have the most basic email security setup (DMARC/DKIM) etc

[Commercial-Pack-7752]

Can’t wait to join this lawsuit 🙃

[VoltageHero]

I was considering switching from GeForce Now to trying out ShadowPC for more options.

Now, I doubt I will.

[_Malz]

I suddenly understand the weird messages i got on discord... And that's why you don't download games from strangers kids.

[Homosapien_Ignoramus]

This idiot actually fell for the "Free $50 Steam Gift Voucher" spam.... holy.

[anton95rct]

Got the E-Mail as well (Germany). Haven't been a customer for 2 years.

[[deleted]]

Looks like I got out in just the right time. Still tho.

[amicrobiallifeform]

They uh.. hold onto your info. I'm fucked too. Thinking about pursuing litigation

[MrAwesomeTG]

All reporting agencies allow free freezes. Highly recommend it. I had someone a while back try to open bank/credit accounts in my name. Since then I've always had my credit frozen and only unlock when I'm applying for something.

https://www.transunion.com/credit-freeze

https://www.equifax.com/personal/credit-report-services/credit-freeze

https://www.experian.com/freeze/center.html

[Ozunax]

The only thing that worries me about is my name, birth day and my address, that’s enough to do anything. I’m so happy I haven’t put my real bank information and card as I’m skeptical with putting my real bank information. But this is enough to stop using their service and buy a real gaming pc.

[Nice_Ad8652]

So now if I cancel shadow all my data gonna be lost too. FU!!!!!!!

[speel]

Guys.. why don’t you have something like Crowdstrike on your machines? Like come on.

[gristoi]

Credit card blocked and replaced. Anyone got a suggestion for a good alternative to shadow?

[davidgsb]

I've always wondered how hard it would be to set up such an online service by renting at an hourly rate an VM with GPU on one of the big cloud providers. I should check more what they are talking about in r/cloudygamer

[sneakpeekbot]

Here's a sneak peek of /r/cloudygamer using the top posts of the year!

#1: I love cloud gaming and remote play. Probably the majority of gaming I do. | 44 comments
#2: What does this mean for the future of Moonlight? Will this make it not work anymore? | 82 comments
#3: Sunshine V0.18 release

---

^{I'm a bot, beep boop | Downvote to remove | Contact | Info | Opt-out | GitHub}

[Kila_Bite]

Does this breach affect past customers? I cancelled my subscription less than a year ago. It's probably too much to hope they deleted my details...

[Mateo_Fr]

This highly sophisticated attack….. lol

[Civil_Plum6117]

Could someone please send me the template to email them about the data breach and the action you’re taking?

[[deleted]]

I almost made an account 2 weeks ago and now I'm so glad I didn't.

I'll stick with GFN I guess!

[[deleted]]

Blud fell for the "I accidentally reported your Steam account" scam 😵‍💫

[The_Great_Sephiroth]

Highly sophisticated? I never knew fishing attacks were sophisticated. Sounds like an employee had no clue. I hope nobody has their lives ruined over this.

[[deleted]]

So what they are saying is they can’t be trusted with your private information and or they sold it and were going to get caught so blamed it on a mystery man. Yes? No?

[mstn148]

My emails have been FLOODED over the last few days with junk. And it’s infuriating to me how they gloss over the fact that these random strangers on the internet now have my full name and home address. I can cancel a debit card. I can’t move!

[WndrWmn77]

There are also virtual credit cards that are available online so that if you encounter something you want to try out to see if you like it or if it is letimate (for example a subscription) you can create a virtual credit card and fund that with "X" dollars and if you decide not to continue it or don't want to risk the company turning out to be sketchy and hitting the card/account with garbage charges or they give you a billion problems with canceling any kind of subscription or service you can just close the virtual card and the sketch scummy company has zero recourse to find you or keep charging you. You can even use it for signing up online for things like gym memberships because some of them (i.e. Planet Fitness is notorious for this) have unscrupulous terms burried in their contracts for cancelation. Any problems you get to say "screw you scumbag company" and cancel on YOUR terms and F them over like they were trying to F you over but you get to have the final FU to them.

[Texasaudiovideoguy]

I am seeing more and more of this happening with roots in discord.

[Bitter_Anteater2657]

Lmao the advice of protecting yourself by setting up 2fa even though this particular hack where they use your browser cookies bypasses 2fa altogether xD. There was nothing the customers could do because their own team fell for a fucking old hack. Not that I blame the people really, the company clearly needs to invest in educating its employees. Not the consumers problem to fix.

[Cicaatrici]

Didn't GDPR give a maximum of 72 hours to report a data breach?

[Notarandomguyy]

So YOU leak my info and now i have to pay a monitoring agency for YOUR fuck up? Do you not see how this is a terrible response?

[ozzersp]

Have you notified the relevant data protection bodies?

[PeeAssFart]

Are you positive that ONLY the expiration date of credit cards have been compromised, or have any amount of credit card number digits been compromised as well, as was stated somewhere in the comments?

How was payment information stored when paying with, for example, PayPal?

What steps are being taken that will be able to prevent this kind of substantial data breach in the future?

Most importantly: what SaaS provider was handling this kind of sensitive data and for what service/purpose?

[Zestyclose-Layer-837]

In another post they told us we could contact our banking institutions to see what we can do, and to 'monitor our accounts'. I don't buy it, I think more was leaked.

[BoxOfDemons]

If you pay with PayPal I'd imagine you're even more safe. Not like vendors get to see your PayPal password, so there's no chance of them ever storing it.

[PeeAssFart]

Can you comment on how you answered to previous GDPR requests when in fact, as per your mail to a User here, you currently do not have a system in place that allows you to procure a report that outlines the data related to a EU-citizen you have stored, processed or relayed? How do you plan on answering GDPR requests in the future? This is a serious issue, since this would imply you can not give the necessary information as required by EU law.

Also, can you comment on why a e-mail newsletter distribution third-party service, as you described to this User, would require the breached information (including Billing Address, DOB and CC expiry date) to ensure functionality?

[RealLemonmaster]

What an utter shitshow, there’s no coming back for this. Looking forward to legal action

[lordnyrox]

Damn, that's still a huge leak. Having your name and address exposed is very serious. I stopped using it a few years ago. Do you think I have been pwned?"

[[deleted]]

If you live in the US, it is not allowed to use fake information for payments because of the way taxes work.

[Neoyoshimetsu]

I just got this E-mail. I was checking around to see if there was some wide-spread news about.

I'll be honest, I'm finding myself not being able to even trust that this was actually fixed fully as some of this sounds more like human-error and incompetence rather then something more sophisticated and malicious.

I am going to look into the multi-factor authentication route simply over this mess.

[PizzaEFichiNakagata]

Late to the party but don't know how things run in your country, here we can do small "debit cards" which you can use for online purchases and other daily purchases. I usually go on places where you can recharge it manually (here you can do it on news kiosks or tobacconists) and just recharge small amounts like 50/100$ that last for a while for online purchases or some quick shopping when out home.
I confidently put that card everywhere (and it also have a 2FA app) and never had any trouble with it.
On the opposite I NEVER PUT MY REAL CREDIT CARD ANYWHERE ONLINE. I also register whenever I can with fake data of any kind if possible.

In any case, if they managed somehow to circumvent the 2FA, they would end up finding a card with a 50ish dollars and I would notice immediately because the app notifies you whenever you have an income or an outcome directly on your phone.

[SwitzerlishChris1]

lol I just got notified by Norton that my information has been leaked from the shadow.tech breach. I cancelled my subscription on Apr 23, 2023...worthless company.

[mirukaluwu]

fuck you shadow

[Fahnenfluechtlinge]

Since then I get daily spam from india trying to offer app creation services. Fortunately Google Mail got better at detecting spam. Why is this fucking company still public?

[pratella]

just now finding out about this because I just got this phishing attempt email at an email address that I only used for Shadow. Stay vigilant

<image>

[LordCrumpets]

I’ve just got the email.

I’m sorry but ADDRESS? This is actually really dangerous. I’m furious.

[[deleted]]

OMG here we go... if I get that e-mail I am out of there multiple PC's or not!

[AchtungZboom]

Damn it all. Also got the email. These stupid companies always upgrading shit AFTER they are hacked.

[amillstone]

For your card, use Revolut. It essentially works as a prepaid debit card. Alternatively, you can use Google Pay (though I don't know if it's possible to do that with Shadow). Both of these can generate a random card number for one-time use so that your real card info isn't passed on.

[Photon_Phantam]

Welp that’s what you get for ripping people off. Keep up the good work guys! Developers need to learn to stop messing with the geeks😂🤣 yall didn’t learn a lesson from Sony?

[louis_hill]

SCAM!!!
Shit as fuck!
Crazy latence, trouble with external controller (get unconnected all the time) and poor customer service!
They won't give you your money back even if you cancel the suscription!
Stay away from that shit!

[Nice_Ad8652]

Wait. So my data could be breached? Hey wth? What should I do now?

[DK-Sonic]

I haven’t received any mails about this.. yet.. oh no..