They did say that a token that hasn't been used for some time gets removed. And typing the 16 digits plus name plus CVV is different than typing the CVV alone.

And if you have my CC in your hands, you can also buy stuff as me. Assuming you also know my PIN, or CVV in the token case.

Yes. I still want to test how often the CVV is asked for though.

So for now if I know your account pin I did not need anything else to buy a gift?

Account name and password, email password for 2 step authentication and card's CVV. If the account doesn't have two step authentication, you'll need the account name and password and the card's CVV.
Edit: That is assuming the CVV check is IP based or time based.

Maybe to buy gift codes with a stolen credit card, in order to sell the gift codes in places like G2A or whatever it is called? That way, turning it into money. Ka-ching! Then you can use all that money to buy more GOG games. Capital investment man. Smoke? No, those things will kill you. Yeah, you wanna live forever? Dead or alive, you're coming with me.

I used the token during Insomnia and I couldn't find any logic behind it. Sometimes it asked for the CVV twice in a setting and sometimes it didn't ask at all even if I logged in from another device or IP.

It can't be that much money into keyselling but I guess if you are desperate and find some kind of enjoyment behind it..

You can get a virus even from a trusted site, if the ad-network it is using was hacked.

I usually pick up Trojans from the convenience store.

Why does it always seem to be Russians stealing accounts and pirating games? Is Russia really such a lawless land of criminals?

Why does it always seem to be Americans ruining whole countries (Iraq, Libya, Syria) and continents (Africa). Is USA such a lawless land of criminals?

You have the least right to judge, if any.

Yes, next to the Greek yogurt normally.

I'm not judging. Every single stolen account on any site I've ever seen (and there have been more than a few) has had a Russian behind it. It's not judgment, it's observation. It was a simple question because I've never been to Russia, not that I plan to go.

And you're comparing apples to oranges, not that what the American government does is any better. I'm talking about individuals. Unless you want to claim the Russian government is responsible for stealing accounts on gaming and other sites? Most Americans don't support the stupidity of the government to get involved in others' affairs the way they do, especially as selectively as they do. Maybe it's not stupidity, but the motivations are baffling and usually related to money and good PR.

Iraq was already ruined by a dictator foolishly ignoring the UN response to his last grab for power. Then the cry from the American people was to vacate Iraq as fast as possible, because we didn't want to be involved. So the government listened like idiots because once we were already involved it was too late to just leave.

Syria and Libya, I don't know enough about. personally.

I am so glad to see that this was handled so quickly. Major props to Judas, Cwaniak and anyone else who went above and beyond the call over this holiday weekend.

Fesin, be sure to let us know once all of this is truly sorted. It is such a stressful thing when your security is compromised. I hope the damage doesn't run any deeper than this. Fingers crossed!

Hmm.. The Last Federation looks to be only $5.89 in RU-region while $19.99 everywhere else if I looked this correctly.
Is it possible that these russian hackers try to take advantage from these somewhat cheaper regional prices with some games or is it even possible, buy cheap, jack up the price and sell them in G2A whatever shady site.

Buying a game as a gift will use the Canadian (I think) price, not matter what the local price may be. So you can't actually profit from that anymore.