HypersomniacLive: I've lost count how many times we've pointed out how backwards this is, and that they should change it to work proactively, but GOG doesn't seem to listen. *sigh* Did you get an automated email when you opened your ticket? Did you check if it got caught in your spam folder? If you actually didn't get that email, it's likely that your ticket didn't even register with the GOG Supoort System, and you should try again.
I'd assume that restoring accounts to their rightful owners takes priority, but keep in mind that it's a Sunday, and GOG Support operates with a limited number of staffers on weekends. Given that they've put a system in place to begin with, it's quite mind puzzling that they haven't switched it to operate like it should, and does on numerous other sites. Changing it to ask for a confirmation before the change takes effect would also lift the extra workload that the current system introduces for GOG Support, so sticking to it really doesn't make any sense both from a security and business POV.
Sadly, a lot of companies out there - even massive ones - learn these sort of lessons the hard way by eventually being the target of hackers and getting compromised. Sony is probably the biggest of the big to get just about every aspect of their computer networks hacked, both corporate and consumer facing due to poorly managed security policies and practices.
https://en.wikipedia.org/wiki/Sony_Pictures_Entertainment_hack I think these high level hacks happen because the marketplace is naturally highly competitive resulting in companies tending to focus the majority of their internal resources (money, manpower, computing power, hamsters, pizza, etc.) towards putting out new products and services first and foremost with less attention paid on the industry best practices of back-end security infrastructure. Resources spent designing security systems that may be seen as unnecessary because "we've never had a breach before" is much like the average computer user that does not use any antivirus software because "I've never had a virus before, so I dont' need an anti-virus program". Same thing really.
We as humans protect ourselves against threats based on a combination of our perception of the existence of threats and our mental model of what the threat is and how it works, and based on whether or not a given threat has previously been a problem. It's risk assessment, conscious or unconscious. When it comes to security threats, people as a whole (as well as businesses) generally mis-perceive the actual threats out there and what the actual risk is and costs to correct a given problem, so the threats get downplayed and not taken quite as seriously. As long as such threats never actually come to fruition and pose actual breaches and damage, the perception they're low-risk remains and allocation of resources to combat such threats is unlikely to happen.
Humans are naturally more reactive than proactive when it comes to risk assessment and threat management, whether it is computer security, business security, nutrition, and just about any other area you can think of. So as a whole we tend to undermine actual real world threats until they actually have happened and we have to deal with them at which point then we are more likely to take them seriously.
I suspect that GOG reviews their security infra periodically and prioritizes improvements based on threat risk-assessment, and that to date their perception of risk of this security issue is low so they haven't allocated their limited resources to do something about it because they have higher priority real world issues that are perceived to have bigger customer impact. Quite frankly, there are probably very few customers even caring about these security issues or expressing concerns to them as the average human being quite honestly is a complete dolt when it comes to computer security and unlikely to remotely care about this kind of stuff.
They'll probably upgrade this at some point in time naturally on their own, but they're much less likely to do it right away unless there is a compelling threat to their business such as a massive account hijack-a-thon happening which causes a massive outrage and exodus of customers spontaneously leading to an urgent damage control mission to put out the fire and drench the flames.
The small number of people who might be affected by problems regarding this security weakness at the moment are just unfortunate collateral damage, which most likely GOG will gladly sort out on a customer by customer basis manually if and when it happens to people.
Every major gaming company at some point in time or another seems to have had a massive user account hijack or password database leak on a pastebin by some teenage h4x0r out there, including Valve, Sony, EA/Origin and others. I hope it never happens to GOG personally, but if it ever does then it could be a sort of making-the-big-leagues "OOPS" tattoo they can wear on their journey to sit beside the various industry giants like Sony who have been breached multiple times.
Battle scars! :)
