Skip to main content

Genshin Impact developer says mobile number leak has been plugged

Genshin Impact guide
(Image credit: MiHoYo)
Audio player loading…

Update: In an email, MiHoYo said that the problem with linked mobile numbers being displayed in full on the password recovery screen has now been corrected. "Our team indeed noticed the systematic issue and took immediate action to fix the problem," a studio rep said. "The issue should be gone now."

Comments in the Reddit thread (opens in new tab) that attracted attention to the issue also indicate that the issue has been resolved. Unfortunately, there's no indication of what the problem was or, more importantly, how long mobile numbers attached to MiHoYO accounts were leaking or how many users may have been impacted. I've reached out to the studio for more information and will update if I receive a reply.

Original story:

Genshin Impact (opens in new tab) players on Reddit are reporting what could be a fairly major potential privacy breach on the MiHoYo website. The site's forgotten password page offers an option to send a recovery code to linked mobile phone numbers, and in some cases it's apparently displaying those numbers in full rather than partially censoring them.

Redditor TiltOnPlay (opens in new tab) posted a screen illustrating the problem:

(Image credit: miHoYo)

Any email address can be entered into the "forgot password" page, after which the option to verify the account can be switched to using a linked mobile number rather than an email address—meaning that anyone can enter an address and potentially access the user's mobile number. Aside from the obvious downsides of having your phone number exposed to the world (which, as CNet (opens in new tab) explains, can be quite serious), several users have pointed out that leaving data lying around in the open like this is also a big violation of the EU's notoriously strict privacy laws.

Many Genshin Impact players in the thread say that their numbers are being properly covered up, and both Steven and I tried it and found the same thing—we entered our email addresses into the account verification screen, and the attached numbers came up censored. Location may be a factor, although there doesn't appear to be enough commonality to really nail it down at this point—several Indonesian players say their numbers are covered, but people from other locations in Asia and at least one in North America claim that theirs are fully exposed.

Giving the allegations some credence is the fact that this isn't actually the first report of this problem: Redditor skydtlee posted about the same issue (opens in new tab), also with screens, three weeks ago. That thread went largely unnoticed, though, so the problem is only coming to widespread attention now.

Andy Chalk
Andy Chalk

Andy has been gaming on PCs from the very beginning, starting as a youngster with text adventures and primitive action games on a cassette-based TRS80. From there he graduated to the glory days of Sierra Online adventures and Microprose sims, ran a local BBS, learned how to build PCs, and developed a longstanding love of RPGs, immersive sims, and shooters. He began writing videogame news in 2007 for The Escapist and somehow managed to avoid getting fired until 2014, when he joined the storied ranks of PC Gamer. He covers all aspects of the industry, from new game announcements and patch notes to legal disputes, Twitch beefs, esports, and Henry Cavill. Lots of Henry Cavill.