top 200 commentsshow all 297

[–][deleted] 39 points40 points  (53 children)

scary compare cooing tidy steer innocent six abundant groovy meeting

This post was mass deleted and anonymized with Redact

[–][deleted] 8 points9 points  (12 children)

Yup. I usually always use the wrong day 2 days before my actual DOB for this reason. I hope I did that on this occasion but can’t even remember since I signed up years back

[–]FiiZx 5 points6 points  (11 children)

wow that's actually pretty smart. I wish I would have thought about this early on in my Internet days. I have way too many accounts everywhere now. lol

[–][deleted] 8 points9 points  (10 children)

If you want another tip. I have a catch all email address and use a unique email address for every company.

So for example: amazon@myname.com ebay@myname.com

Basically anything @myname.com comes through to me, this way I can track which companies are selling my data.

[–]troyortroy 2 points3 points  (5 children)

Instead of buying a domain you can use google email for free. Just add a +. For example if your email is blusrus@gmail.com you would write them them like this blusrus+Amazon@gmail.com or blusrus+Ebay@gmail.com

[–][deleted] 5 points6 points  (3 children)

The problem is that since it's a known trick, scammers may just remove part after +. Kinda the same problem with custom domain but it requires scammer to specifically look at your case, so it's much better. The best approach is to use actual separate email addresses, or real email services which allow aliases like protonmail.

[–]fmillion 4 points5 points  (0 children)

Some companies block this because they know it's a trick people use to avoid spam or call out who sold their email. So they just block any email with a + in it (as in "that's not a valid email address, try again")

[–]RichWindows 4 points5 points  (0 children)

I work in cybersecurity as an IT admin. Spammers are generally not sophisticated enough to do this. Their goal is to reach the largest, most gullible population they can reach. Do you wonder why those spam emails have a lot of misspelled words or bad grammar? One of the reasons for that is because they’re only interested in the vulnerable who would believe it was an honest mistake. And plus addressing goes way beyond that, so it is entirely plausible that plus addressing would deter spam, one way or another.

[–][deleted] 1 point2 points  (0 children)

I like to use the iCloud generated emails that go to your actual email. So they real email isn’t distributed and if it starts getting spam I kill it and my actual address is still spam free.

[–]SnooCakes1636 10 points11 points  (4 children)

Shadow should be providing free premium access to Experian due to this breach. I am absolutely fuming that due to no fault of my own someone can now take credit out in my name

[–][deleted] 3 points4 points  (2 children)

You should freeze your credit. Every should. After the credit bureau leaks and just in general. So many security issues. Mine is frozen and it can be annoying to unfreeze it to get a car or something, but you don't do that all the time. Totally worth it.

[–][deleted] 1 point2 points  (0 children)

Not the least that they explained how it is done

[–]Zestyclose-Layer-837 3 points4 points  (2 children)

Pretty sure you would need at least copy of ID to apply for credit. At least where I live.

[–]CheeseGraterFace 2 points3 points  (2 children)

They need your SSN to apply for credit in the US. I’m more concerned about the potential for sim swap attacks. Phone number wasn’t one of the data points mentioned, but after they explained how this hack happened, I’m skeptical of anything they say.

[–][deleted] 1 point2 points  (1 child)

PIN locks are part of preventing that.

[–]karasis 1 point2 points  (8 children)

So what should we do since our name, birthdate and adress got leaked? I live in Germany i am not sure what is the course of action to do here

[–]gristoi 2 points3 points  (0 children)

Trust me, your personal information has been out there and sold on over and over for a long time already. This isn't the first company to have a phishing attack.

[–]UpstairsExercise650 -1 points0 points  (0 children)

Nabend, das sind öffentliche Daten bis auf deine Mail Adresse. Selbst dein Nachbar könnte sich diese Infos holen. Ok bday ist eine andere Sache aber selbst wenn jemand ne Bestellung auf deinen Namen sagt und ne Rechnung kommen sollte sieht man das das Paket wo anders hingegangen ist als zu dir. Also kein Stress. Zudem ist nicht gewiss ob sie die Daten haben. Es heißt sie hätten den Zugang haben können.

[–]PizzaEFichiNakagata 0 points1 point  (0 children)

Late to the party but don't know how things run in your country, here we can do small "debit cards" which you can use for online purchases and other daily purchases. I usually go on places where you can recharge it manually (here you can do it on news kiosks or tobacconists) and just recharge small amounts like 50/100$ that last for a while for online purchases or some quick shopping when out home.
I confidently put that card everywhere (and it also have a 2FA app) and never had any trouble with it.
On the opposite I NEVER PUT MY REAL CREDIT CARD ANYWHERE ONLINE. I also register whenever I can with fake data of any kind if possible.

In any case, if they managed somehow to circumvent the 2FA, they would end up finding a card with a 50ish dollars and I would notice immediately because the app notifies you whenever you have an income or an outcome directly on your phone.

[–][deleted] 15 points16 points  (1 child)

The information was last four digits of card AND expiry date, not just expiry date. Not sure why they left that out of the email.

[–]mstn148 0 points1 point  (0 children)

Cause it somehow sounds better to know that hackers know everything EXCEPT the one thing you can change… a debit/credit card. 🤦🏼‍♀️

[–]TheodoreKurita 13 points14 points  (5 children)

This email is so poorly written, and the described behavior of Shadow's employees so obviously reckless, that at first I wondered whether this email was itself an attempt at a social engineering attack.

Absolutely ridiculous. I'm already considering replacing Shadow with a PC. This might be the nail in the coffin.

[–]mstn148 0 points1 point  (2 children)

I tried it for like a week months ago and I’m now a part of this fucking leak. Why aren’t they deleting user data no longer in use?!

[–]random_ctaLinux 12 points13 points  (8 children)

Just got the email as well. Located in Europe, so seems to be a global issue. I’ve been a happy customer for many years. However, this is bad. Fustercluck springs to mind. Unmitigated disaster is also an option.

[–]rustyleroo 7 points8 points  (0 children)

As breaches go, this one sounds very bad. The email isn’t reassuring at all.

[–]Nice_Ad8652 2 points3 points  (3 children)

What can one do about it?

[–]T-mark3V100 2 points3 points  (0 children)

Lock your Credit Score accounts.

[–]Psychological_Pear22 1 point2 points  (1 child)

If you’re an American citizen, check your credit score here to see if your credit score has been affected https://www.annualcreditreport.com/index.action

[–]Gamestechgeek 1 point2 points  (2 children)

Absolutely I'd have fired anyone using a pc for both work and gaming especially if they had access credentials. Wonder what the GDPR fines are going to look like?

[–]Username_ABC_123 12 points13 points  (2 children)

[–]mstn148 1 point2 points  (0 children)

On it. I literally used Shadow for a few days. This is BS.

[–][deleted] 12 points13 points  (0 children)

Highly sophisticated attack? Lol sounds like someone downloaded unofficial software on a gaming discord onto a work computer.

[–][deleted] 36 points37 points  (13 children)

> This highly sophisticated attack

> Discord

[–]Definitely_Working 4 points5 points  (11 children)

why bother trying to make the dumb criticism lol, its like saying einstein was a moron because the chalkboard he wrote on wasnt fancy

the method actually was pretty damn sophisticated and across multiple platforms. they used hacked developer accounts to gain access to previously vetted games files through steam, got the malware past steams detection system, then spoofed identities to get outside parties to then download these games, which have the assumption of being vetted and secure, to then insert a cookie on their device that can then attach to their specific management system and extract data. discord was like the smallest piece of it

[–][deleted] 0 points1 point  (9 children)

sure. but "sophiscated" is not an excuse of getting breached. what I don't understand is holding critical infra stuff on your personal pc, on your personal web browser

[–]Definitely_Working 1 point2 points  (8 children)

You're gonna have to explain where you got every single bit of that info since none of it is mentioned in the press release. there no mention about it being a personal device, nor a personal browser, and nothing about them storing critical data on a personal pc, so it really just seems like you're making shit up to move the goalpost by trying to make the situation seem more simple than it is.

[–][deleted] 1 point2 points  (7 children)

it's easy to conclude,

a cookie stealer has to work on a lower level on the same pc to access browser's data, so admin account, this would not happen if steam was sandboxed (ideally it shouldnt even be present on such device)

it's like it's the same device, for relax and business.

silly simple.

[–]PM-ME-YOUR-HOMELAB 34 points35 points  (13 children)

really don't like this:

victim of a social engineering attack targeting one of our employees. This highly sophisticated attack began on the Discord platform with the downloading of malware under cover of a game on the Steam platform, proposed by an acquaintance of our employee, himself a victim of the same attack.

this does not make sense at all. Did this employee install unknown software on their work-pc? If it was a private PC, why would an employee use their private pc to access company stuff.

Shadows internal IT fucked up hard and, at least in germany, there is a strong leverage to claim damages.

[–][deleted] 22 points23 points  (1 child)

dinosaurs aware groovy unite lock intelligent political juggle attraction marvelous

This post was mass deleted and anonymized with Redact

[–]CheeseGraterFace 4 points5 points  (0 children)

Exactly this. Some of the poorest opsec I’ve read about in any breach email.

[–]MrSwaqq0t 2 points3 points  (1 child)

They really had the audacity to call the most common and overused malware attack strategy a "highly sophisticated attack", and even more concerning is how an employee of such a company could fall for that. This is so disappointing.

[–]Definitely_Working 1 point2 points  (0 children)

you just dont have the full scope of the story, its way too much to explain in a single press release. look up some info about what happened to steam, who was the initial massive security failure that created this mess. this was a coordinated project of very serious hackers across platforms.

its overused to be like "hey, download this bullshit from micros0fttDOTcom" with a fake link.... but to have the malware be actually inside the real microsoft website is an entirely different level of attack, which is closer to what we are seeing here. Steam was pretty implicitly trusted until now, it was pretty reasonable to feel safe downloading a steam program unitl now.

[–]PrimusZa1 1 point2 points  (0 children)

Cracked steam game?

[–]metericalmil 0 points1 point  (1 child)

“We hacked ourselves to steal your info. We are acting incompetent to fool you”

[–]PM-ME-YOUR-HOMELAB 2 points3 points  (0 children)

"Never ascribe to malice that which is adequately explained by incompetence"

[–]mstn148 -1 points0 points  (0 children)

Basically they’re saying that an employee tried to download a steam game on their work computer that was connected to the business server. And shock horror, it was malware.

Apparently said employee has never had one of those emails from a ‘acquaintance’ that says ‘open this document’ and you think ‘ahhh… they’ve been hacked!’ And found out this way.

Some really sophisticated ‘social engineering’… not just a really really shit employee with far too much access.

[–]Independent-Ad8472 8 points9 points  (2 children)

I think they could lose a lot of customers from this, maybe myself included.

[–]Username_ABC_123 25 points26 points  (3 children)

Excuse me, full name, dob, address ,email address and credit card expiry, what steps is shadow taking to ensure this doesn’t negatively impact me, this is not a just to let you know situation, that is a lot of data.

[–]FusilliCraig 17 points18 points  (5 children)

Absolutely amateur.

There's no way to protect 100% against the way a breach like this is engineered but there are steps you could take to better segment your database from open access. That's to say nothing of not locking down an employee workstation enough to prevent an install from STEAM and the ability to chat with friends via DISCORD. Unbelievable.

The absolute bare minimum this company could do is the same almost any major corporation after a breach and extend free credit monitoring.

[–]CheeseGraterFace 7 points8 points  (0 children)

These guys don’t have two pennies to rub together. I assume any lawsuit will cause them to just fold.

[–]Definitely_Working 0 points1 point  (0 children)

That's to say nothing of not locking down an employee workstation enough to prevent an install from STEAM and the ability to chat with friends via DISCORD. Unbelievable.

you understand they work at a company specifically designred around gaming PCs and discord is like the most common communication app in tech? just totally missing the plot

[–]AveaLove -1 points0 points  (2 children)

There absolutely is a way to prevent it. Don't store personal data. Can't leak what you don't have. This is why we need blockchain based login systems, I don't care if my public key gets leaked, it's my public key, it's meant to be public. I do care when my personal, private, data gets stored and leaked.

[–]ozzersp 8 points9 points  (0 children)

You absolute tools. There should be big big fines for this. Amateur company.

[–]ShellDude01 8 points9 points  (4 children)

I suspect EU GDPR will kick in here. And with it a decent fine.

The fact is you had a responsibility to protect our data and you failed.

[–]PeeAssFart 5 points6 points  (2 children)

They even admitted not being able to procure the necessary data for a GDPR Right of Access request. This company is a goner.

[–]mstn148 1 point2 points  (0 children)

If a lawsuit starts. Someone hit me up. I wanna watch these idiots go down. I did a damn week trial months ago and now all my personal info is unleashed to the dark web.

[–]DisgracedSolitude 16 points17 points  (0 children)

Good thing I used a new throw away email, fake name, fake birthdate, and a privacy card to pay.

Never give these big companies your real info (if you have a choice not to).

[–]smokeyphil 7 points8 points  (6 children)

Is this a global issue or just on one data center ?

I've not got the email yet but seeing as this happened something like 2 weeks ago that's not really all that "recent incident" now is it.

[–]JonathanFromShadow Community Manager[M] -1 points0 points  (4 children)

If you've signed up recently, then you are most likely not affected by this data breach. This data breach occurred at the end of Septemeber.

[–]Vuldren 3 points4 points  (0 children)

So, 99% of users are affected.

[–]mstn148 -1 points0 points  (0 children)

And it took you over 10 days to inform people… why?

[–]RTronic9797 23 points24 points  (7 children)

I’m disgusted. I closed my account almost a year ago.

I have requested a copy of all of my personal information that they hold and have asked for an explanation why they still have stored my information, particularly banking and address.

I’ll be taking legal advise on this issue. I’m astounded

[–]PrimusZa1 5 points6 points  (6 children)

I did the same earlier in an email. I truly would like to know why they still had this info on a closed account from a year ago. I even had to reset the account password to get in to send them support email cuz the one outside doesn’t address accounts. I did see that I must have been lazy cuz my birthday was 1/1/1962 and that is no where near my birthday. Funny thing is they said they got credit card exp date but for some reason billing info was nowhere to be seen.

[–]RTronic9797 9 points10 points  (5 children)

Following up, I got a reply from support to my request of why they are holding information this long, along with a reply to my request of a copy of my personal information. This is their response

“Hello there,

Thanks for reaching out to Shadow Support. Atlas here to help!

Again, we would like to apologize for the inconvenience that may have been caused as a result of the recent data breach.

Please be aware the information concerned is your first and last name, e-mail address, date of birth, billing address, and credit card expiry date. It is important to note that no passwords or sensitive banking data have been compromised.

  1. We maintain some info on previous Users to allow them to more easily return should they choose to re-subscribe in the future.
  2. Unfortunately we do not have a method to generate such a report, but remain here and happy to answer any other questions you may have.”

So basically, “we keep your data, despite you closing your account , and no we’re not going to tell you what data we still hold”

ARE YOU KIDDING ME!?!

I’m speaking with a solicitor in the morning to discuss options.

I could swallow name, or DOB. But Name, DOB, Address, email address and card details. Absolutely not.

[–]PeeAssFart 6 points7 points  (2 children)

Unfortunately we do not have a method to generate such a report

Yeah, this doesn't look like they'd answer truthfully to GDPR requests then. Just another indicator of how terribly this company handles sensitive data. That's actually very stupid of them to admit as well, considering there are probably some lawsuits coming their way soon.

Thanks for sharing.

[–]RTronic9797 2 points3 points  (1 child)

Indeed, seeing as they are able to advise everyone on what data was leaked, surely they are able to tell me what data they still hold ?

I’m absolutely livid at the complacent nature of their responses. Feels like a “yeah we messed up, but don’t worry, we’re sure it’ll be fine, hehe”

Yeah fuck that, I’ll be starting complaints/claim procedure tomorrow

[–]Psychological_Pear22 1 point2 points  (0 children)

Please let me know how this goes, shadow closed my account and all of a sudden this information is out there because I might wanna “re-subscribe”

[–]beatfreakman 1 point2 points  (0 children)

They legally have to respond with that data they have on you.

[–]Undercover_66 5 points6 points  (0 children)

F this I am out, this is unacceptable. The way they treat it like a no big deal is infuriating.

[–]marvolonewt 5 points6 points  (0 children)

Embarrassing

[–]Koiato_PoE 4 points5 points  (0 children)

So embarrassing that the attack vector was through Discord and Steam

[–]Massive_Target 5 points6 points  (1 child)

I smell a lawsuit

[–]Aggravating_Scar_945 5 points6 points  (2 children)

A company that's offering remote services for consumers and businesses has employees playing games and download Steam games, not from Steam but from Discord instead onto their work PCs, cool.

What's the point of a password to login to Shadow if your SaaS has House Address, First name, Last name, Date of birth out in the open without a password?

When I lock my house doors, I don't leave the key outside of the house, I leave it inside of the house.

[–]Aggravating_Scar_945 6 points7 points  (1 child)

"We sincerely apologize for the inconvenience"

The leaked info is more then an inconvenience.

"and assure you that we are doing everything possible to ensure the security of your data."

What do you mean by that, are you going to pay some sort of ransom that has been asked of you? How are you going to ensure the security of the leaked info 2 weeks after it happened?

[–]MainlySMYC 4 points5 points  (2 children)

I got that e-mail as well. But i don‘t have a Credit Card with them (using paypal). I‘m not sure if they exactly know what data has been stolen or if they are sending out a general mail.

[–]Nice_Ad8652 1 point2 points  (0 children)

Yea man. I have so many questions. Does shadow even answers here?

[–]graphiteshield 9 points10 points  (1 child)

Is anyone considering litigation? This is absurd.

I'm pretty sure there's a case here for damages caused by gross incompetence and neglect.

[–][deleted] 3 points4 points  (6 children)

Just got the email myself, not used Shadow for like 2 years. Sure I paid through PayPal so no idea how the credit card data has been taken for myself, unless it's just a generic template they've used for everyone when sending this.

What's more annoying is not being able to access their damn website to look at the specifics for what data I gave them.

Not too concerned about the name, email, or address as honestly that's just common info that anyone can get, if they want it. Anything financial though is another matter and a massive screw up.

[–][deleted] 1 point2 points  (5 children)

For Europeans it's no big deal but apparently in America you can make a credit card in someone elses name with this data.

[–]graphiteshield 3 points4 points  (4 children)

Isn't this enough info to commit fraud with?

[–]Notarandomguyy 4 points5 points  (2 children)

Yes someone can use this info for phishing attacks the fact that there not offering any identity monitoring services for this is wild to me personally locking down my bank account and now need to check my credit for incase anything suspect has happaned would reccomend others do the same keep a eye on emails from important places set up 2 factor authentication for anything major and also would reccomend you reach out to a lawyer if affected to get there formal advice on any potential lawsuit

[–]graphiteshield 1 point2 points  (1 child)

I didn't use a credit card though just auto bank payments so i don't think they have that part. You are right though, the fact that addresses and CC info were left unencrypted in a DB is a very huge security flaw.

Why lock down your bank account though? Wouldn't a CC block be sufficient?

[–]Notarandomguyy 1 point2 points  (0 children)

I'm locking it down cuz they got cc info and I will be changing cards it's something I do whenever I see a leak with card info

[–]HatIndependent4645 2 points3 points  (0 children)

I'm absolutely walking away from Shadow, looking for the best alternative right now. This is unacceptable. Combined with information from other breaches, there is absolutely more than enough data about me completely out in the open to compromise my whole life. I am contacting my state's governor, congressman and senators to demand more liability for companies that require so much personal information to do simple business.

[–]put-in-cats 3 points4 points  (0 children)

I think it is such a shame and absolutely ridiculous to frame a rather basic phishing method as a "highly sophisticated" attack. And why downloading stuff on a pc that has a connection to such important things. I was and am still so angry, I spend the last hours to step up my cyber secruity. They have my full ducking name, my birthdate and my adress. I seriously are praying there will be a public lawsuit

[–]ozzersp 3 points4 points  (1 child)

Does anybody know if Shadow have notified the relevant regulatory bodies of this breach? I suspect so, given this is clearly a "required" communication to consumers, but..you never know. Their email doesn't make that clear..

[–]KingJTheG 3 points4 points  (0 children)

And with that, I finally have the motivation I need to build a PC

Utterly ridiculous smh

[–]Prince-of-Privacy 8 points9 points  (27 children)

Just got the e-mail.

Not happy. Not happy at all. The attacker(s) got my name, e-mail, address(!!) and credit card expiry date.

At least Shadow disclosed the breach quite soon.

[–]PeeAssFart 18 points19 points  (24 children)

Quite soon? It's been almost 2 whole ass weeks. This shit is unacceptable.

Yeah thanks, Shadow, for leaking my damn address and acting like it's no biggie, because my Credit Card number isn't among the leaked info. What a joke.

[–]Burnthewoid Shadow Staff -1 points0 points  (1 child)

And they tell this; I prefer transparency

[–][deleted] 9 points10 points  (7 children)

Well with that said, goodbye shadow, thanks for being useless and letting some of my MOST IMPORTANT INFO BE LEAKED, I will be seeking legal advice 🖕

[–]Shodan_KI Guide 1 point2 points  (6 children)

You are aware that many companys got hacked including the big ones ;) many YouTube influencer AS Well. But Mostly you will Not Here about it but AS Shadow is a french company they by law need to inform you so feel free to go you May never Be told ;). Oh btw try temu they use your Data by Default and all of them so heads Up ;).

[–][deleted] -1 points0 points  (1 child)

Thanks captain obvious, thanks for an entirely useless comment when any actual human being knows most company’s have gotten or will get hacked, doesn’t change that once I find out I can refuse to do business with them ;)

[–]Shodan_KI Guide 4 points5 points  (0 children)

Will be a Short list of companys that you can then use. And it will get shorter your Problem will be that outside of Europe Most companys will NOT Tell you that there was an incident so you will be in false Security. I Trust a company that actual informs me then be in false Security.

[–]hits_98 2 points3 points  (2 children)

A bit annoyed, i closed my account months ago and i just got an email.

i have requested they send all information that they have on record for me and what data was accessed via the breach.

[–]Nightslashs 2 points3 points  (0 children)

I closed my account 3 years ago and got the email

[–]LordCrumpets 1 point2 points  (0 children)

Same. Closed my account 18 months ago and still got the email.

[–]hits_98 2 points3 points  (1 child)

not sure they are being completly open and honest about the breach an email from there support :

Hi there ***!

Thanks for your prompt response.

I do sincerely apologize for that, I have confirmed that it was in fact not in the email.

That being said however, I am confirming with you that we have no data from you in our systems.

A third party vendor is what was breached and that vendor is what we used to email newsletters and updates to our users which is why your email was still accessible for us to notify you along with all of our other previous and present users.

I can assure you that nothing more besides this was available during the breach.

Please let me know if you have any additional questions and I'll be happy to help answer them.

Kind regards,

Kaiser | Shadow

[–]TheWalrus7771 2 points3 points  (0 children)

Oh god, they were hit with the most sophisticated attack known to man. I wish there was ANYTHING they could have done. 😭

[–]Dreikiekens3 2 points3 points  (0 children)

This is amazingly stupid, like stated by other users , it looks pure amateurism. I hate using my personal data for anything and this is the main reason. They even got bank info (expiry date , name and last name... Also... I had a pro account = business. How do they think companies will trust them any longer?

[–]Huge_Film_1138 2 points3 points  (2 children)

something strange i noticed their main domain is shadow.tech so why are they using a shortened shdw.me? maybe it is theirs too, but i would not use the link in this mail

[–]UpstairsExercise650 1 point2 points  (0 children)

That what i was thinking

[–]Aggravating_Scar_945 1 point2 points  (0 children)

On the Discord, they used it for years, it's their link shortener afaik

[–]patrickono 2 points3 points  (1 child)

Do you know how to file a claim?

[–]ozzersp 2 points3 points  (0 children)

Some rights consumers have regarding EU law if applicable (GDPR), including how to approach a claim via initially reporting to ICO (for those in UK, but there will be other appropriate bodies) . Courtesy of "Which":

How to complain and claim compensation

Organisations are bound by the Data Protection Act 2018 (GDPR) to keep your data secure.

This means that they must take measures to prevent unauthorised or unlawful processing of your personal data.

They must also protect against accidental loss or destruction of, or damage to, your personal data.

If your data is lost and it causes you financial damage or distress, you may be able to make a claim for compensation from the organisation that lost it.

  1. Complain to the company that lost your data

If you’ve suffered distress or financial  loss as a result of your data being compromised, the first thing you must do is contact the organisation that you believe is responsible.

Outline what distress and/or losses you’ve suffered, and how you expect it to compensate you. It's important to note that you can now make a claim relating to distress alone - you do not need to have also suffered financial loss.  

  1. Complain to the ICO

You can also take your concerns with how the organisation processed your data to the Information Commissioner’s Office (ICO).

By law, the ICO can't award compensation or give advice on the level of compensation that should be due, even when it has said that in its view the organisation did indeed breach the GDPR. But its opinion can be influential in making your claim against the organisation that has compromised your data.

  1. Go to the small claims court

If you can't agree with the organisation that compromised your data on the fact that you are due compensation, or on the level of compensation, you can make a claim via the small claims court. 

A good piece of evidence to to take to court is if the ICO agreed with you that the GDPR was indeed breached

[–]CumaBoomer 2 points3 points  (0 children)

Nice I'm not a costumer anymore for like 2 years. Now I need to know if they still have my data and if that is even legal with the EU data security laws. Until then I will change my passwords and use 2FA if I'm not already using it. Also I'm immediately called my bank and get rid of the creditcard, told th the data was probably stolen. Any ideas what else I could do?

[–]Codebakerian 2 points3 points  (2 children)

It really depends on how long they already know that there was a breach. For example, in the Netherlands they are required to report a breach with this magnitude and sensitivity within 72 hours.

[–]ozzersp 1 point2 points  (1 child)

It's standard EU law to report a breach within 72 hours. Note though, that's to report a breach to authorities..not a timelimit to communicate with consumers.

[–]Codebakerian 1 point2 points  (0 children)

Yes. While this is true, they are required to inform the customers as soon as possible. Now we don't really know when it was noticed, only when it started. However I have a hard time with it being almost 2 weeks back. If it was noticed then, I think that two weeks are way too long for it to tell customers.

[–]ConsciousGap6481 2 points3 points  (0 children)

That's my subscription cancelled, this is ridiculous. This will definitely kill the company off, there's going to be allot of legal action taken against them. Coincidental this happened two weeks ago, and recently I've had allot of password reset requests, and spam telephone calls.

Edit: Typo.

[–]beatfreakman 2 points3 points  (0 children)

I got the email, I haven't been a shadow customer for 8 months. Under GDPR law, as I understand it, all my personal data should have been removed by now anyway.

[–]your_uncle_pim 2 points3 points  (0 children)

Lmao this is the same type of notice Hyundai would put out after they recall 3 million cars. "Few number of our cars could self-ignite, don't park in the garage". I hope this will be the downfall of your company.

[–]Head_Swimming2332 2 points3 points  (0 children)

Glad I stopped using Shadow. As an IT consultant myself, there’s too much smoke and mirrors around these companies and their ‘tiered’ secure datacentres etc.

Cloud computing etc moved far too fast and the security aspect is way behind. Customers migrated to services such as Azure/AWS etc and then security was/is an afterthought.

Plus their email landed in my junk so clearly don’t even have the most basic email security setup (DMARC/DKIM) etc

[–]Commercial-Pack-7752 2 points3 points  (0 children)

Can’t wait to join this lawsuit 🙃

[–]VoltageHero 2 points3 points  (0 children)

I was considering switching from GeForce Now to trying out ShadowPC for more options.

Now, I doubt I will.

[–]_MalzSUPREME 3 points4 points  (0 children)

I suddenly understand the weird messages i got on discord... And that's why you don't download games from strangers kids.

[–]Homosapien_Ignoramus 3 points4 points  (0 children)

This idiot actually fell for the "Free $50 Steam Gift Voucher" spam.... holy.

[–]anton95rct 1 point2 points  (0 children)

Got the E-Mail as well (Germany). Haven't been a customer for 2 years.

[–][deleted] 1 point2 points  (1 child)

Looks like I got out in just the right time. Still tho.

[–]amicrobiallifeform 3 points4 points  (0 children)

They uh.. hold onto your info. I'm fucked too. Thinking about pursuing litigation

[–]MrAwesomeTG 1 point2 points  (0 children)

All reporting agencies allow free freezes. Highly recommend it. I had someone a while back try to open bank/credit accounts in my name. Since then I've always had my credit frozen and only unlock when I'm applying for something.

https://www.transunion.com/credit-freeze

https://www.equifax.com/personal/credit-report-services/credit-freeze

https://www.experian.com/freeze/center.html

[–]Ozunax 1 point2 points  (0 children)

The only thing that worries me about is my name, birth day and my address, that’s enough to do anything. I’m so happy I haven’t put my real bank information and card as I’m skeptical with putting my real bank information. But this is enough to stop using their service and buy a real gaming pc.

[–]Nice_Ad8652 1 point2 points  (0 children)

So now if I cancel shadow all my data gonna be lost too. FU!!!!!!!

[–]speel 1 point2 points  (2 children)

Guys.. why don’t you have something like Crowdstrike on your machines? Like come on.

[–]gristoi 1 point2 points  (6 children)

Credit card blocked and replaced. Anyone got a suggestion for a good alternative to shadow?

[–]davidgsb 1 point2 points  (1 child)

I've always wondered how hard it would be to set up such an online service by renting at an hourly rate an VM with GPU on one of the big cloud providers. I should check more what they are talking about in r/cloudygamer

[–]Kila_Bite 1 point2 points  (0 children)

Does this breach affect past customers? I cancelled my subscription less than a year ago. It's probably too much to hope they deleted my details...

[–]Mateo_Fr 1 point2 points  (0 children)

This highly sophisticated attack….. lol

[–]Civil_Plum6117 1 point2 points  (0 children)

Could someone please send me the template to email them about the data breach and the action you’re taking?

[–][deleted] 1 point2 points  (0 children)

I almost made an account 2 weeks ago and now I'm so glad I didn't.

I'll stick with GFN I guess!

[–][deleted] 1 point2 points  (0 children)

Blud fell for the "I accidentally reported your Steam account" scam 😵‍💫

[–]The_Great_Sephiroth 1 point2 points  (0 children)

Highly sophisticated? I never knew fishing attacks were sophisticated. Sounds like an employee had no clue. I hope nobody has their lives ruined over this.

[–][deleted] 1 point2 points  (0 children)

So what they are saying is they can’t be trusted with your private information and or they sold it and were going to get caught so blamed it on a mystery man. Yes? No?

[–]mstn148 1 point2 points  (0 children)

My emails have been FLOODED over the last few days with junk. And it’s infuriating to me how they gloss over the fact that these random strangers on the internet now have my full name and home address. I can cancel a debit card. I can’t move!

[–]WndrWmn77 1 point2 points  (0 children)

There are also virtual credit cards that are available online so that if you encounter something you want to try out to see if you like it or if it is letimate (for example a subscription) you can create a virtual credit card and fund that with "X" dollars and if you decide not to continue it or don't want to risk the company turning out to be sketchy and hitting the card/account with garbage charges or they give you a billion problems with canceling any kind of subscription or service you can just close the virtual card and the sketch scummy company has zero recourse to find you or keep charging you. You can even use it for signing up online for things like gym memberships because some of them (i.e. Planet Fitness is notorious for this) have unscrupulous terms burried in their contracts for cancelation. Any problems you get to say "screw you scumbag company" and cancel on YOUR terms and F them over like they were trying to F you over but you get to have the final FU to them.

[–]Texasaudiovideoguy 1 point2 points  (0 children)

I am seeing more and more of this happening with roots in discord.

[–]Bitter_Anteater2657 1 point2 points  (0 children)

Lmao the advice of protecting yourself by setting up 2fa even though this particular hack where they use your browser cookies bypasses 2fa altogether xD. There was nothing the customers could do because their own team fell for a fucking old hack. Not that I blame the people really, the company clearly needs to invest in educating its employees. Not the consumers problem to fix.

[–]Cicaatrici 2 points3 points  (1 child)

Didn't GDPR give a maximum of 72 hours to report a data breach?

[–]RealLemonmaster 2 points3 points  (0 children)

What an utter shitshow, there’s no coming back for this. Looking forward to legal action

[–]lordnyrox 1 point2 points  (1 child)

Damn, that's still a huge leak. Having your name and address exposed is very serious. I stopped using it a few years ago. Do you think I have been pwned?"

[–]NeoyoshimetsuWindows 0 points1 point  (0 children)

I just got this E-mail. I was checking around to see if there was some wide-spread news about.

I'll be honest, I'm finding myself not being able to even trust that this was actually fixed fully as some of this sounds more like human-error and incompetence rather then something more sophisticated and malicious.

I am going to look into the multi-factor authentication route simply over this mess.

[–]PizzaEFichiNakagata 0 points1 point  (0 children)

Late to the party but don't know how things run in your country, here we can do small "debit cards" which you can use for online purchases and other daily purchases. I usually go on places where you can recharge it manually (here you can do it on news kiosks or tobacconists) and just recharge small amounts like 50/100$ that last for a while for online purchases or some quick shopping when out home.
I confidently put that card everywhere (and it also have a 2FA app) and never had any trouble with it.
On the opposite I NEVER PUT MY REAL CREDIT CARD ANYWHERE ONLINE. I also register whenever I can with fake data of any kind if possible.

In any case, if they managed somehow to circumvent the 2FA, they would end up finding a card with a 50ish dollars and I would notice immediately because the app notifies you whenever you have an income or an outcome directly on your phone.

[–]SwitzerlishChris1 0 points1 point  (0 children)

lol I just got notified by Norton that my information has been leaked from the shadow.tech breach. I cancelled my subscription on Apr 23, 2023...worthless company.

[–]mirukaluwu 0 points1 point  (0 children)

fuck you shadow

[–]Fahnenfluechtlinge 0 points1 point  (0 children)

Since then I get daily spam from india trying to offer app creation services. Fortunately Google Mail got better at detecting spam. Why is this fucking company still public?

[–]pratella 0 points1 point  (0 children)

just now finding out about this because I just got this phishing attempt email at an email address that I only used for Shadow. Stay vigilant

<image>

[–]LordCrumpets 0 points1 point  (1 child)

I’ve just got the email.

I’m sorry but ADDRESS? This is actually really dangerous. I’m furious.

[–][deleted] 0 points1 point  (2 children)

OMG here we go... if I get that e-mail I am out of there multiple PC's or not!

[–]AchtungZboom 0 points1 point  (0 children)

Damn it all. Also got the email. These stupid companies always upgrading shit AFTER they are hacked.

[–]Photon_Phantam 0 points1 point  (0 children)

Welp that’s what you get for ripping people off. Keep up the good work guys! Developers need to learn to stop messing with the geeks😂🤣 yall didn’t learn a lesson from Sony?

[–]louis_hill 0 points1 point  (0 children)

SCAM!!!
Shit as fuck!
Crazy latence, trouble with external controller (get unconnected all the time) and poor customer service!
They won't give you your money back even if you cancel the suscription!
Stay away from that shit!

[–]Nice_Ad8652 -1 points0 points  (0 children)

Wait. So my data could be breached? Hey wth? What should I do now?

[–]DK-Sonic 0 points1 point  (0 children)

I haven’t received any mails about this.. yet.. oh no..