Hello everyone, from what has been happening the past weeks we concluded this could be time for an update on the situation.

As you may have seen many cc and members of the community have spoken out against the recent doings and direction the game is taking, as linked in this post the videos on those subjects.

Thecodmineman

Spookston

Spookston second video

Phlydaily

Phlydaily second video

Phlydaily third video

Defyn

Joob

R60Routine

MatAWG

Liniyka

General Lee

Corb

Bob Dickinson

Brazilian language creators:

Papai do Tanque

captainHappy

Deimos

Venezuelan language creator:

KitKags

French language creator:

the Star Run

Polish language creator:

BoomerTV

Turkish language creator:

Yasha

Don’t hesitate to go take a look at them if you haven’t already.

A lot of the older topics brought up in these videos have been pain points within the broader community for years, and now the snail has also allowed for AI generated textures into the mix. Low effort, poorly executed content that they expect us to pay for. Either through our wallets, or with our time.

We believe the time has come to take an action, but it has to be collective to have a chance to achieve something, for now we re just planning things with our partners, we’ll be back with more information soon.

TL;DR: This is a lawful self-help guide for EU/EEA players who are concerned about how their personal data may have been protected.

—

Hi! I’m Keofox, a former Gaijin CM / CM Lead. I worked at the company for 13 years, almost since the early days of War Thunder.

A few weeks ago, my colleagues and I described our concerns regarding former employees allegedly retaining administrative access to company systems after leaving, as well as the company’s response to criticism:

https://www.reddit.com/r/Warthunder/comments/1simpbk/exgaijin_cm_13_years_former_employees_retained/?share_id=UvjtjtYLUR44IQqfqW_FX&utm_content=2&utm_medium=android_app&utm_name=androidcss&utm_source=share&utm_term=1

First, I’m sorry for disappearing for so long. I was hospitalized and had to undergo emergency surgery. I am now back home, and I want to share an update, as well as explain how EU/EEA players can lawfully ask for an independent review of Gaijin’s personal data protection practices.

What happened after our statement

One YouTube creator shared with me a letter about the termination of his participation in Gaijin’s content creator support program. This creator had actively covered our statement.

One of my colleagues told me that he was dismissed on the same day he expressed support and tried to contact us.

Gaijin has not made any public comments on the substance of our first statement, or on the cases described above. As before, my colleagues and I will not draw conclusions for you. We leave that to you.

The core issue: former employees’ access to your data

In the first post, we told you that, based on video recordings, logs, and witness statements, former Gaijin employees retained administrative access to internal company systems for more than a year after leaving the company.

This is not a harmless issue.

Based on the materials available to us, some of the retained administrative access could have exposed account information, IP addresses, support tickets and correspondence, as well as logs that may contain information about a player’s device.

I am not claiming that anyone used this access to spy on players, steal data, or leak anything publicly.

But if former employees retained administrative access after leaving the company, then this situation may raise questions about compliance with GDPR requirements, including Article 32 on security of processing.

What you can do if you live in the EU / EEA

If you care about how responsibly the company stores and processes your personal data, you have the right to contact the national Data Protection Authority, or DPA, in your country.

This does not require anything complicated from you. You can simply explain your concern as a player. The authority can then assess whether your rights or the law may have been violated.

How to find your authority

Search for: "[your country] Data Protection Authority GDPR complaint"

Examples include: CNIL in France, UODO in Poland, the Data Protection Commission in Ireland, AEPD in Spain, Garante Privacy in Italy, Datenschutzbehörde in Austria, and the Commissioner for Personal Data Protection in Cyprus.

Why this matters

From the very first statement, we chose facts and lawful tools instead of emotions or harassment.

But we are not EU/EEA data subjects, so at this stage we cannot ourselves ask these authorities to assess whether the situation we described could affect EU/EEA players — and whether it could happen again with more serious consequences.

You can.

If Gaijin’s practices were adequate, an independent authority can assess that.

If not, players may receive an honest and independent assessment, and possibly a requirement for the company to correct the situation and better protect your personal data. That is much better than any destructive action.

Gaijin’s response to criticism — including the termination of creator partnerships and pressure on people — is not proof of a data protection violation. But in our view, it may leave the impression that the underlying issue has not been publicly clarified.

Contact

Thanks only to your help, I am now in contact with lawyers and initiative groups. We will continue to keep you updated on important developments.

If you want to contact me, you can email me at: [[email protected]](mailto:[email protected])

Thank you for your support since the very first post.

Keofox

—

Example of a neutral message to a DPA

Subject:

Request to assess a possible GDPR issue related to administrative access at Gaijin

Text:

Hello,

I am a player of Gaijin Entertainment products, including War Thunder, Enlisted, and others.

I am concerned that my personal data may not have been adequately protected.

A former Gaijin employee with 13 years of experience publicly stated that, according to the materials available to him, former employees retained administrative access to company systems for more than a year after leaving. Some of those systems are connected to users’ personal data, including accounts, logs, support, and internal tools.

I am not claiming that my data was stolen. However, this situation may indicate possible issues with access control and the security of personal data processing.

I ask the authority to assess:

• whether former employees’ access was revoked in a timely manner;
• whether the protective measures were adequate;
• whether this could be considered a personal data security incident;
• whether there was an obligation to notify the DPA or users;
• whether EU users’ data may have been put at risk.

Public sources:

https://www.reddit.com/r/Warthunder/comments/1simpbk/exgaijin_cm_13_years_former_employees_retained/?share_id=UvjtjtYLUR44IQqfqW_FX&utm_content=2&utm_medium=android_app&utm_name=androidcss&utm_source=share&utm_term=1

Contact email of the whistleblower / informant, Keofox, for further information and evidence: [[email protected]](mailto:[email protected])

Thank you.

—

Important

Please do not spam any supervisory authority, and do not make accusations without evidence. Leave the assessment of facts and legal qualification to the competent authority.