My VPN is off. And the 2FA email I got was written in Cyrillic. After I logged in the site stayed in Russian, I had to click English.

My wife logged in to my account on her tablet, which has NEVER ACCESSED THIS SITE BEFORE. And 2FA was not required. What kind of bubblegum and duct tape security are you running here, GOG?

Random locale change happened to me couple times, probably nothing to worry about.

For 2FA I think GOG checks only IP. I clear all cookies and cache on every browser exit and 2FA only triggers when IP is changed from previous login. So if tablet was in the same network I think it's as intended.

mine goes to polish and sometimes german.
and I have the same thing with same devices on the same network, when my laptop still worked I never had to 2fa on my phone I only had to 2fa when I signed in on my chromebook, my theory is GOG ignores the last three characters of the I.P but I could be wrong.

GOG's geolocation can occasionally have an aneurysm. Been swapped to the German store a couple of times, including the geoblocked games not showing up on the store. Usually fixes itself in a couple of hours.

I used to get German at times, but hasn't really happened in a while. Geolocation glitches are not uncommon. The best bubblegum and duct tape security in the world, of course :P.

Happened to me also, in the past.
My preset language is English.
I had everything else instead: German, Polish, Russian, French and Chinese...it's just another glitch in the GOG universe.

Happened to me too a couple of times.

Usually changing manually the language setting (or, for some reason, the currency) switches back to your default/chosen one for the next time you log in.

Or refreshing your account: https://www.gog.com/account/refresh

The 2FA register your IP, not your system, so if you log from one place will have access on that place. As soon as you change your log in place, it will send you an autentication mail.

Guess it's good the language change isn't a big deal, but GOG, dude. If someone has no cookie being logged in from the site, require 2FA regardless. IPs can easily be spoofed, my friends.

You don't have to worry paladin, the 2FA still give you an extra layer of protection with your mail, and your mail probably has 2FA with your phone or another mail and that make it like 4FA, you are safe, the problem with the lenguage was probably a bug.

Except there was no 2FA for my wife's device on the same IP. IP addresses can be spoofed meaning someone could pretend to be on my home network from anywhere. If they don't have a login cookie from GOG (as my wife's device did not) and it still doesn't trigger the 2FA prompt, how will 2FA help me?

If GOG is acting buggy today, might explain why I didn't get an email "inviting" me to claim that Lovecraft game like the last one for Dex. Site seems a bit slower than usual with the sale going on.

Hey paladin181, then it seems is time to reconsider your own personal security strategy
And there are many improvement areas to choose, few to mention:

-Complexity & length of your password
-Cost benefit analysis of your public profile and the details you share there
-Another public info you share (like country)
-Browser password storage
-Browser cookies strategy/config
-Browser hardening (fingerprinting, extensions, etc)
-IP renewal frequency
...

All to answer/remedy the fundamental thing:
Why and how bad actors would botter to choose/stumble_upon your account as a target?

From my side, I'll only disclose that I haven't experienced any language change
In such case, that alone would ring some alarms here...
But kind of mitigated by the recent login attempts page info, right?
...Hold on a second...


About 2FA: IMO a silly placebo remedy (to keep it short & mild)
But when the whole world is blindy adopting it in a more enforced/mandatory ,,trendy,, way,
even giving up extra personal info to Corpos in pursuit of the highest noble security goal...
Well... as you may infere, any opposite opinion, lets say:
is totally dumb &/or immediately discarded/ridiculed in automatic (to keep it short & mild again)

Good luck finding your own personal and private enhancements
May you find your own tranquility level, nobody else will do it for you

NEVUR5GET https://www.gog.com/forum/general/warning_massive_security_risk_on_gog/page1

Actually never got such issue. if i use VPN\plugins to change IP - when i go to Cart GOG recheck IP and change region. While GOG change region it change defalut locale language. Yes, that happen for me. But only if GOG detect changed county by IP's.
Stayin at same IP - i stay in same region and on same language.

So it is something random and very rare. if we talk about GOG. if it is often - maybe not a GOG side issue?