Update: In an email, MiHoYo said that the problem with linked mobile numbers being displayed in full on the password recovery screen has now been corrected. "Our team indeed noticed the systematic issue and took immediate action to fix the problem," a studio rep said. "The issue should be gone now."
Comments in the Reddit thread that attracted attention to the issue also indicate that the issue has been resolved. Unfortunately, there's no indication of what the problem was or, more importantly, how long mobile numbers attached to MiHoYO accounts were leaking or how many users may have been impacted. I've reached out to the studio for more information and will update if I receive a reply.
Original story:
Genshin Impact players on Reddit are reporting what could be a fairly major potential privacy breach on the MiHoYo website. The site's forgotten password page offers an option to send a recovery code to linked mobile phone numbers, and in some cases it's apparently displaying those numbers in full rather than partially censoring them.
Redditor TiltOnPlay posted a screen illustrating the problem:
Any email address can be entered into the "forgot password" page, after which the option to verify the account can be switched to using a linked mobile number rather than an email address—meaning that anyone can enter an address and potentially access the user's mobile number. Aside from the obvious downsides of having your phone number exposed to the world (which, as CNet explains, can be quite serious), several users have pointed out that leaving data lying around in the open like this is also a big violation of the EU's notoriously strict privacy laws.
Many Genshin Impact players in the thread say that their numbers are being properly covered up, and both Steven and I tried it and found the same thing—we entered our email addresses into the account verification screen, and the attached numbers came up censored. Location may be a factor, although there doesn't appear to be enough commonality to really nail it down at this point—several Indonesian players say their numbers are covered, but people from other locations in Asia and at least one in North America claim that theirs are fully exposed.
Giving the allegations some credence is the fact that this isn't actually the first report of this problem: Redditor skydtlee posted about the same issue, also with screens, three weeks ago. That thread went largely unnoticed, though, so the problem is only coming to widespread attention now.
