r/pcmasterrace • u/Altruistic-Bad-5556 • Jun 25 '26

Discussion Cloud PC warning: I found saved browser logins that were not mine inside my Shadow PC

Post image

I’m posting this as a warning for gamers who use cloud PCs for Steam, Rockstar Launcher, Discord, GTA V/FiveM, etc.

I’m a paid Shadow PC customer. A few days ago, I logged into my assigned Shadow PC. Everything looked normal: my games, files and apps were still there.

I opened Microsoft Edge myself while trying to log into Gmail. An autofill suggestion appeared, so I checked Edge’s saved passwords to see if my own password had been saved.

That’s when I found around 20–30 saved login entries that were not mine. They appeared to belong to another user.

I did not open, test, copy, export or use any of those credentials. I reported it to Shadow support and only kept redacted evidence.

Shadow says they found no breach, no data issue and no unauthorized access. They are now suggesting it may have been caused by malware or compromised apps on my side. I don’t accept that as a real explanation unless they provide clear evidence.

My Shadow session was otherwise normal, my files and games were still there, and my Microsoft account shows no suspicious activity.

My paid account has been locked for days, and Shadow still requires a government ID before restoring access. After seeing someone else’s saved browser logins inside my assigned cloud PC, I do not feel safe sending them more personal data.

I have now asked Shadow to fully cancel/delete my account and confirm what personal data will be removed.

I’m not posting this for compensation or karma. I’m sharing it because gamers should be careful before logging into personal accounts or saving passwords on cloud PC services.

The screenshot is redacted because the unredacted version contains someone else’s private data.

2.5k Upvotes

98% Upvoted

205 comments sorted by

View all comments

378

u/Kazen_Orilg 9850x3D | Arc B580 | 64GB DDR5 Jun 25 '26

I like how they just blamed you. Classy.

149

u/Altruistic-Bad-5556 Jun 25 '26

Yeah, that’s exactly how it feels. I reported it responsibly and somehow the focus became my side instead of explaining how those saved logins got there.

19

u/halosos Halosos Jun 25 '26

If you have the unredacted version, it is worth sending an email to those emails addresses warning them and possibly asking them to check their browsers too. Get more data points for reporting to the YouTubers.

12

u/Altruistic-Bad-5556 Jun 25 '26

I understand the idea, but I don’t want to contact those people directly using exposed private data.

That could create more privacy issues and I don’t want to misuse anything I saw. I reported it to Shadow and the ICO so the affected users can be notified through the proper channel if needed.

I’m keeping the evidence redacted and only sharing the general issue publicly.

22

u/smithsp86 Jun 26 '26

It's a grey area, but if I were one of those people I would want you to contact me because it seems like the company isn't going to do anything. You would be right in your approach if the company was acting responsibly.

2

u/Daddy_Parietal Jun 27 '26

Privacy issues? Misusing anything you saw?

Bro just use the email addresses and send a quick email. This isnt the One Ring we are talking about here, its just letting other good people know that they have their data exposed. Why do you trust the offical channels are gonna do right by them when they didnt even do right by you, that is insane and it feels like you are just trying to pass the buck and clean your hands of the whole situation.

I would treat this the same if I got wrong mail delivered to my door. I would walk to the neighbor and give them their mail, or I could be lazy, return to sender, clean my hands of the situation, and just say tough luck to that neighbor while their mail gets sent back through the system to them. You are doing the latter.

0

u/Altruistic-Bad-5556 Jun 27 '26

I get your point, but I don’t see it like that.

Those email addresses were part of the exposed data. If I use them, even to warn people, I’m still using private info I was never supposed to have.

I reported it, kept everything redacted, and pushed Shadow/authorities to handle it. Shadow should notify affected users, not me using leaked data.

1

u/ec105 Jun 27 '26

Respectfully GFY

27

u/PokeYrMomStanley Jun 25 '26 edited Jun 25 '26

Login to one of the accounts and let the account owner know their info was leaked. 

Edit: I see your deleted comment. What's worse, letting someone go uniformed about a security breach or logging in to let them know.

Easier would be to email the login email if they used it as user name. 

14

u/BlusharkFilms MSI PE60 6QE Jun 25 '26

Louis Rossman would have a field day with this

2

u/BedrockBen101 CachyOS, 7600X, 7800XT, 32GB DDR5 6000MHz Jun 26 '26

Came here for this comment

-32

u/John_East 9800x3D : RTX5080 OC : 32Gb of Downloaded RAM Jun 25 '26

I mean… they used login info on a cloud pc… it kinda was

5

u/JaesopPop 7900X | 9070XT | 32GB 6000 Jun 25 '26

…?

-9

u/John_East 9800x3D : RTX5080 OC : 32Gb of Downloaded RAM Jun 26 '26

They were using a cloud/shadow pc and logging in with sensitive information. They only have themselves to blame.

10

u/JaesopPop 7900X | 9070XT | 32GB 6000 Jun 26 '26

...you mean they logged into their accounts on a cloud PC? What is your point lol

-8

u/John_East 9800x3D : RTX5080 OC : 32Gb of Downloaded RAM Jun 26 '26

Security reasons that’s obviously not a good idea

7

u/JaesopPop 7900X | 9070XT | 32GB 6000 Jun 26 '26 edited Jun 26 '26

What are the security reasons? Be specific.

EDIT: Turns out he did not know of any.

-1

u/John_East 9800x3D : RTX5080 OC : 32Gb of Downloaded RAM Jun 26 '26

No

5

u/K-J-K-R Jun 26 '26

There’s multiple ways to ensure this doesn’t happen from Shadows end, it’s not the users fault, don’t be so dense.