I had been hacked in a similar way. Support took a while but they helped me recover my account.

Exactly, that's what I think he's doing. When he first hacked my account, I couldn't access my account through the website, as the password was different, but I opened Galaxy and just like that, I was logged in and able to use my library, but couldn't change my email or password because I didn't know the new password this guy set. Only when the support team helped me, I could get a new password.

So this is exactly what is happening now but in reverse, although I changed the password, since he once logged in, Galaxy will open even if I change the password. Thus, he can access my library, but not change the pass again.

Oooh boy. No.

"Ding a ding-dang, my dang-a-long ling-long"

That is not good. :|

EXACTLY!!!

JESUS BUILT MY HOTROD!!!

*does the secretly secret secret-handshake dance

Exactly, not good at all, especially since it's been a week since their last email which only said

"Please change you e-mail for a while, this should help."

and they haven't answered any of the 2 following emails I sent, I even opened a new ticket (I thought that maybe the first one was tagged as "solved" by mistake) and still no answer... It's been already 2 weeks since this guy got into my account and it feels like I won't get any help from the support team... So I don't know if there is a way to "summon" someone from the staff so they can communicate with me through this thread or something

You can try and chat <span class="bold">Firek</span>. It's more than slightly ridiculous that GOG can't or doesn't reset all sessions after you recovered the account.

Thank you! Done! I can't believe I'm about to solve this! Hope Firek can help me, cause I was starting to get a bit desperate haha!

And yeah, I guess it should be super easy for them to reset all sessions, so lets hope this trouble ends soon! ;)

Poor russian cracker, of all the accounts, he had to crack SolrakSG's

s/he must have been very disappointed with the lack of games in your account :P

just kidding

Always scan your system for trojans / keyloggers before you shutdown and after you boot up, it only takes five minutes [with malwarebytes for example].

all the best

one question though - how do you know you have been hacked?
(suddenly I become paranoid someone might already hacked my account without me realizing it)

The trick to sufficient security is to make it hard enough for would-be attackers that the effort vs reward ratio is not worth it. I find it's a great rule of thumb to remember.

Real hackers compromise entire web sites or at least target very wealthy individuals for a lot of money.

Nobody will invest significant amounts of time "hacking" individual GOG accounts. It's just not valuable enough.

If they broke into your account, it's because you made it ridiculously easy for them to do so. I recommend you review your habits and try to guess where you got complacent.

For example, one of my friends kept getting his emails hacked. He'd change it every year or so. I found his claim that web mails are extremely easy to break into dubious, because I got mine for a very very long time.

Finally, I decided to fish a little bit while we were waiting at the restaurant and asked him questions about his habits.

Turned out he used the same password everywhere so essentially, he was giving away any website he registered to his email account and the password to login to it!

95%+ of security is not arcane arts, it's caution and common sense.

GOG doesn't store CC information.

I'm waiting for the new computers that are advertised with facial recognition locks rather than passwords and wondering how many people will be flashing or mooning their computers to access them.

Something to consider: It's entirely possibly that the poor sod using your account is not actually hacker, but someone who purchased your account at some shady website, not realizing that they are doing anything illegal. "Hackers" ( or whatever you want to call them ) get hold of user login details, and then sell them to others to make a profit. Seems especially likely if you have hot new releases such as Witcher 3 on your account, and it's really the only profitable reason why hackers would mess with the accounts of legitimate users. If they just wanted to play the games, they could get them elsewhere, especially since they are all DRM-free.

It's basically a similar problem as those websites re-selling "region-discounted" GOG game keys, or game keys bought with stolen credit cards.

Also: Another reason not to use Galaxy, since the hacked accounts always(?) seem to be Galaxy users.