Not necessarily. Using Galaxy since very first alpha and no one stole my account with Tyrian 2000 on it, yet.. ; )

I've been thinking about this same. Could be a problem with nvidia way of redeeming The Witcher or using VPN in some cases..

That doesn't invalidate my argument. If it's a general vulnerability in Galaxy we would have seen someone with 1.000+ rep getting their account stolen. Or a blue. We'd also have seen a hell of a lot more people getting their account stolen.

But we haven't. The total numbers and the zero rep trend point to a cause outside GOG/Galaxy.

Indeed. Also, forums regulars are more likely to spend a lot of time on the Intercatworld, which means they are more likely to have failsafe credentials protocols.

But their argument was that it's a vulnerability in Galaxy. You can't put up failsafes against having you credentials stolen through a bug in the client.

Oops, a bit of my post was 'eaten'.
I meant to add :
We know that some of the people that got hacked didn't use galaxy at all (allegedly), one of the only thing that would make sense is people (edit : I mean hackers) using 'old' lists of credentials to try to harvest and resell gog accounts with The witcher 3.
I have yet to hear someone tell he got hacked whereas he had a strong and unique password for his gog account.

It could also be a combination of factors, such as TW3, Galaxy and NVidia codes. It wouldn't be the first time a vulnerability was caused, not by a single piece of software in itself, but by the way two or more software processes interacted with one another.

It was a bit confusing for me, as I stated lost password for email, hence my confusion ;)

Yeah, but some people are just ..... some people O-) I think you know what I mean ;) You never used throwaway I assume, some of them just stay for a day or so. Yes some users and owners of computers are so stupid, they shall have not the right to even own one. Sorry if it sounds harsh. But you need a driving license for driving, you need a license to operate a lot of things, some of them even trival....but for f*cks sake, not for computer....A lot of problems are coming from stupid users. Let´s say passwords: Yes 12345 is still one of the most common ones!!!!!

And sorry didn´t see your post 7, we must have typed at the same time ;)

Here for GOG slightly different, but as some people above (or below your post) pointed out, if this has something to do with any promotion/sale from another side, yes the Problem might come from there and even related to e-mails being used there.

Like:

Enter e-mail on Vendor A to get your code for GOG TW3

Here, if they used there normal e-mail might be already a problem. As I said before, I would use on a for me unkown website a throwaway account, just to get the code. Most users don´t bother.

Now they might even have to go to Vendor B

see above

finally they reach GOG, but because of weak password (or even wrong Galaxy, I read somewhere that their is already a hacked version of Galaxy)

Yes, a lot of users a plain stupid (when it comes to computers)! You can ask anyone working in IT-support!

For your point about continues access, didn´t say anything against it ;)

Maighstir:

Again, a lot of users are not intelligent enough for the web. Same goes for smartphones....How many idiots are not even applying the most basic security....Just think of, how many gazillion times have companies/websites/friends warned people:

DO NOT OPEN ANY ATTACHMENT FROM AN UNKNOWN SOURCE!!

And it is still No.1 for Virus infection.

For the support, see above ;)

Before I forget: Yeah, some people do not log in all the time or chat or pester around here ;)

So they might just come for summer/wintersale with a special e-mail address. In the moment, they can just change it, if they forgot.

And one important thing: If you never backed up your emails, how do you want to convince support, that YOU are the legit owner? (ups, talking about lost access to email ;) )

Sorry if I missed out something ;)

It could be just a "classic" case of rootkit + keylogger credentials swipe and nothing whatsoever related to Galaxy...

..some people just deserve the shit they get.
Personally I wouldn't mind a bit if there was an IQ test before one were allowed to have access to internet or even walk out of home in some cases.. ; )

Didn´t wanted to say it so harsh, but my idea as well ;)

Might be not very popular opinion those days but sometimes it is mandatory to say loudly, the king is naked! ; )
No offence to OP at all, just in general..

otherwise i start feeling like in bloody Harrison Bergeron novel..

Right, we forgotten the disclaimer:

None of the above was written in the purpose to discredit or whatsoever the OP ;)

Now this is out of the way ;)

Harrison Bergeron? Doesn´t ring a bell....

Kurt Vonnegut short novel, worth every penny ; ) Also movie, not as good as the novel but still worth giving it a try.

I just read the info of the link, it does sound familiar! I was never good at remembering names or titles....

Might have read/seen it looong time ago ;)

SO tonight I will watch it.

AND

IF I don´t like it, I will slap you silly ;) *getting beer and popcorn ready*

Throwaway accounts are better for cases where you are forced to enter an email to do something like a survey to win a PS4 or something... Who would ever use a throw away account when you put money down on something?

but yeah, if they do, then they are seriously asking for trouble.