oipluckie1: Sent in a ticket the other day about my account being compromised and supposedly it got fixed this morning. But, it didn't get fixed and my account is still being used by someone. I think support my have misunderstood my ticket, and was hoping if there is any way to have support to do a sort of walkthrough with me or something until the problem is sorted out.

I'm not sure what support did but I think they may have just restored my email and password to the original. But that just makes it easy for whoever took my account to reenter that same info and take it again before I get the chance to reset it. I just want them to give me a password or a link in an email so I can go ahead and reset it myself.

I do enjoy GOG, but this is making me worry about my account or any info on GOG if I do get my account back. I'm usually careful with my info and not entirely sure how my account was compromised. I already sent in a ticket, but not sure if they'll be able to sort it out again. Just don't want to have to go through sending a ticket and waiting another day or two (no patience).

I really hope they beef up their security though.

gunsynd: Very busy and sleep time in their country,and unfortunately patience is the key.

oipluckie1: I can't change my password because they changed my email. To be able to change your password requires an email but they changed my email so I'm not able to change the password.

SirPrimalform: You mean the hijacker also has access to your email account or that they've changed the email your GOG account is linked to? You said that GOG support restored the email and password back to the original yeah? Well they've done that so that you can then change them to something the hijacker doesn't know. That bit is up to you.

cogadh: Unfortunately, you can change your e-mail address on your account by just having the password. Since the hijacker already has the old password, they can change the e-mail to something new, then change the password using that new e-mail, blocking the real account owner out.

cogadh: Unfortunately, you can change your e-mail address on your account by just having the password. Since the hijacker already has the old password, they can change the e-mail to something new, then change the password using that new e-mail, blocking the real account owner out.

SirPrimalform: Which is presumably why GOG reset it, so that the OP can do that before the hijacker. I'm guessing they weren't quick enough though.

SirPrimalform: You mean the hijacker also has access to your email account or that they've changed the email your GOG account is linked to? You said that GOG support restored the email and password back to the original yeah? Well they've done that so that you can then change them to something the hijacker doesn't know. That bit is up to you.

oipluckie1: Still no word about my account ._. , but I opened up my chromebook today and it was somehow still logged into my original GOG account and the email address is definitely not mine. It's some weird email ending with @gmai. I tried changing my pw or email but it required me to log in. I looked up gmai and I've read that it's not even a legit email.

gmai.com is a phishing email or something like that, which is obviously suppose to be gmail.com. Not entirely sure how that works.

cogadh: As long as you haven't logged out of the site, you still have the browser cookie that allows you access, even if the password and e-mail has been changed*. It doesn't help you get your account back, but you should be able to access your library at least.

*and this is why no one should ever access their GOG account via a public computer or really any computer that is not your own. I wouldn't be surprised if this cookie flaw is one of the exploits used to hijack some of these accounts.

oipluckie1: Yea, I don't remember logging into my GOG account on my chromebook. But I've only accessed my GOG account on my computers, so I'm not sure how else they were able to access it.

Aningan: A lot of times the breach is caused by using the same email/password combination for other sites. Say a site where you ordered an office chair, or a site with some 'bio' food. Sites like that don't have high security and can be breached. The attacker gets a list of email/password combinations and then tries those combinations on other sites until they get a hit.