The Privacy Company • End-to-End Encryption • Cloud Storage and Communication • Privacy by Design
127.0.0.1
Joined August 2013
- Tweets5.6K
- Following24
- Followers103K
- Likes1.6K
Pinned Tweet
Mainstream cloud storage like Google Drive and Dropbox costs around $5 to $6 per TB. Should privacy-first alternatives cost more? 💸
Privacy shouldn't come at a premium. After all, it should be the standard.
Full breakdown of secure cloud storage in 2026 here 👉blog.mega.io/best-secure-clo…
Couldn’t have said it better ourselves, @naomibrockwell 👇
Moving your Google Drive (or other mainstream cloud services) into MEGA takes a few clicks. No downloading and re-uploading needed and the second your files land they’re end-to-end encrypted. Full guide: blog.mega.io/how-to-export-f…
Google is spying on your drive.
Your photos, docs, & files deserve privacy.
Did you know you can move your entire Google Drive into @MEGAprivacy with a single click? It's E2EE, so only you can see your files. Even Mega can't.
youtu.be/AaXVcAeBjDk
odysee.com/@NaomiBrockwell:4…
📢 MEGA S4 is getting its biggest upgrade yet
MEGA S4 already backs up NAS, media and business archives at petabyte scale. Next, we're aiming for 100,000+ object writes per second and a billion objects, for apps, AI and big backup platforms.
Help us test what’s next: Registration for closed beta access opens soon 🙌
If you have a workload you’d love to bring to S4, this is your chance to test it out. Follow our page to stay posted. More details here
blog.mega.io/mega-s4-q4-2026…
We’ve added Dropbox, OneDrive, and Box to the MEGA migration tool! 🙌
You can now move your files from other cloud services to MEGA in a few clicks: Upload > Import from another cloud service.
With MEGA, your data stays yours, protected by end-to-end encryption by default. So you can keep your files where no service can mine them or train AI on them.
Which cloud storage service are you moving from? 👀
Full blog on how to move your files here: blog.mega.io/how-to-export-f…
Let’s talk about AdFection, because apparently in 2026 not clicking an ad doesn’t mean you’re safe from getting hacked 🙂
Citizen Lab tied zero-click attacks on at least 45 Al Jazeera devices in 2024 and 2025 to Candiru spyware delivered through ads from Discover-Tech, with high confidence. The device only had to load the ad.
Its platform reportedly let customers aim at specific advertising IDs, and ads carrying its script tags showed up in 75,373 apps and 120,768 websites. Nearly 1 in 5 of the bids Citizen Lab analysed appear to carry them.
Google and IAB Europe both listed Discover-Tech as a vendor from 2020 to 2026. The researchers say it “appears to be a front for large-scale ad espionage abuse.” Great vetting work from Google 🙄👏
If loading an ad is all it takes to get hacked, is there any safe way to scroll?
According to Citizen Lab, the script in the ad pings a Discover-Tech server, which apparently checks your IP address and advertising IDs to decide whether you get sent more code. Devices it didn’t pick stay uninfected.
Google has cut Discover-Tech off from its ad exchange platforms and IAB Europe dropped it from its registry in early October. A few other ad platforms have acted too, all after Citizen Lab published.
The lab is also asking regulators to look into whether Discover-Tech and Candiru broke the law.
Full Citizen Lab report here: citizenlab.ca/research/how-d…
It’s 2026, people. You can literally generate strong passwords in one click 🤦
A hacker says password "123456" is all it took to get into Denmark’s national register through an IT contractor’s account, reportedly exposing 8.8 million records. Politiken says at least three of the company’s accounts used it, admin included.
8.8 million records, protected like a gym locker. Nice.
If, for some reason, you also use the weakest password on earth, here's MEGA Pass. It's free mega.io/pass?mct=oct15x
📢 MEGA S4 is now compatible with GoodSync
GoodSync users can now back up and sync from Windows or Mac to MEGA S4's affordable, S3-compatible storage, with 5x free egress.
Here's how to setup MEGA S4 for GoodSync: help.mega.io/megas4/setup-gu…
One word: ads.
Dunkin’s privacy policy says the app may collect precise location and transaction history, and that Dunkin’ “sells” identifiers and transaction history to third parties, including advertising partners.
An app doesn’t need to follow you across other apps and websites to do its job, but some ask anyway.
If an app with no business tracking you asks to track you anyway, tap “Ask App Not to Track” or delete it 🤷
Why does a Discord bot hold this much data? 😳
Double Counter's own privacy policy gives the answer. It links your IP address to your Discord ID to detect alts, and cites GDPR legitimate interests as its legal basis.
Data stays for up to 24 months, and deleting yours only removes your IP while the pseudonymized links between your accounts stay.
That 24 months counts from your most recent detection or verification attempt, so each new one restarts the clock.
So, GDPR gives you the right to erasure but Double Counter's policy also gives itself a retention period that restarts every time you verify. Fun.
Double Counter’s data breach may be much bigger than initially reported, someone in contact with the hacker just sent me more info
The stolen database allegedly contained much more:
-21.7 million verified user records
IP addresses, geographic data, ISPs and Discord usernames
-44.1 million device fingerprint records
14.5 GB of device fingerprint data
-31 million server records
-19.2 million lens-counter records
-14.6 million VPN-attempt records
-831,000 Google user records
~220,000 user emails
~1.08 million Google search records
-A database around 39 GB
>The source also claims Double Counter’s GDPR deletion system did not actually remove all user data.
>According to them, the /privacy deletion command allegedly only removed a user’s current IP, while other information could remain stored, including emails, alternate accounts, their IPs and connections between main and alternate accounts.
>They also claim Double Counter staff deleted messages and banned users who questioned how much data had actually been leaked.
>The source further described an attack chain:
Metabase breach → plaintext password found → same password used on the server → SSH access → logged-in Google Cloud CLI session → access to the cloud environment → database downloaded.
They claim the attackers also obtained secrets, runtime logs and the entire Discord support ticket history.
>One ticket reportedly involved a user warning Double Counter that an ad on its verification page was malicious but the owner refused to remove it because the ad revenue was needed to pay for the servers.
Discord users can't catch a break 🫠
Double Counter, the bot servers used to catch alt accounts, says about 28 million Discord user IDs and usernames and about 27 million IP and location records were at least partly copied and are being treated as exposed.
If you've ever used it on a server, assume you might be in there.
· Look up your email on Have I Been Pwned, which lists about 275,000 (the company says about 1 million were copied, so a clean result doesn't clear you)
· Treat unexpected DMs and server invites like bait, since the company says attackers used its hijacked bot to post their own invite links across about 50 large servers
Double Counter says one vulnerable analytics tool on a forgotten company server was the way in. From there, attackers reached the bot's token and about 12 GB of data.
The irony is Double Counter bot is a server 'protection' bot
A new data breach involving Double Counter has exposed information connected to Discord users affecting around 275,000 unique email addresses.
According to Have I Been Pwned, the exposed data includes:
-Email addresses
-Discord usernames
-Names
-Geographic information
-Country and postcode for some paying subscribers
The breach was linked to a vulnerability in Metabase, the analytics platform used by Double Counter.
If you’ve used Double Counter on Discord, check whether your email was affected and stay alert for phishing attempts or suspicious Discord messages.
Would you fall for this? 👀
This email appears to come from a real Google address, and the link starts with google.com. Attackers can now ride on Google and Microsoft's own sign-in and alert features, and AI has cleaned up the typos that used to give them away.
Phishing emails are getting more sophisticated, so the safest habit is to skip the link and open the app or type the address yourself.
We detail more about this on our latest blog blog.mega.io/fake-google-sec…
Full thread here xitter.cf/VincentBounce/status/2…
je viens d'être la cible du phishing le + sophistiqué de l'histoire informatique
- je reçois par email une prétendue alerte qui m'indique que j'aurais généré un accès tiers à mon compte Google pour un utilisateur @gmail que je ne connais pas
- l'email de l'émetteur no-reply＠accounts•google•com a tout d'un mail officiel @Google et Gmail ne mentionne pas la moindre alerte de suspicion
- je clique sur le lien, car le site de phishing hébergé sur le domaine google•com semble 100% legit, il fait même semblant de faire des vérifs de sécurité avec un CAPTCHA
- même mon password manager me propose de remplir l'email/pwd car j'ai un vrai compte sur sites•google•com (c'est Google qui offre l'hébergement de sites web)
- si je remplis les champs email/pwd, le hacker les récupère instantanément pour se loguer et récupérer tous mes accès Google/YouTube
cette attaque va faire mal, j'ai report à Google
comment j'ai compris que c'était du phishing ?
1 : le bouton d'action des emails Google est sensé être le gros bouton bleu, pas un lien juste au dessus
2 : en allant voir dans les détails le sender [mailed-by] est fwd•privateemail•com et non *bounces•google•com
We searched "how to turn off Google AI overview" three ways. The plain search led with an AI Overview that told us it can't be permanently turned off.
Very transparent of them 🙂
Adding -ai removed the Overview along with anything useful, and left us with a video carousel that had nothing to do with the question.
Only the Web filter gave us plain links that answered it. Google's own Search Help points to the Web filter as the closest option, and it only lasts for one search.
Google is doing everything it can to force AI Overview to users by making the other options inconvenient and unusable.
Fortunately, you can always #deGoogle. It's not the only search platform, after all. Good luck out there
OpenAI just launched "dots", always-on agents that work across 4,000+ apps and learn what you need over time. Oh, and data from your connected apps can be used to train its models unless you turn training off.
Typical AI company data-harvesting stuff 👍
OpenAI also says human review can still happen in limited circumstances, even with model improvement turned off.
So remember to turn off AI model training and set up your own guardrails before you hand any agent the keys.
Just keep in mind a human may still end up reading your dot's activity 🤷♂️
If you didn't know yet, here's how to opt out of AI training from the largest platforms in the world blog.mega.io/how-to-opt-out-…
