The Privacy Company • End-to-End Encryption • Cloud Storage and Communication • Privacy by Design
127.0.0.1
Joined August 2013
- Tweets5.6K
- Following24
- Followers103K
- Likes1.6K
Pinned Tweet
Mainstream cloud storage like Google Drive and Dropbox costs around $5 to $6 per TB. Should privacy-first alternatives cost more? 💸
Privacy shouldn't come at a premium. After all, it should be the standard.
Full breakdown of secure cloud storage in 2026 here 👉blog.mega.io/best-secure-clo…
WARNING: Google can now use your Gmail, Drive, and photos for ads
In familiar Google fashion, the data-collecting company quietly updated its privacy policy on 16 October, and news sites only spotted it just this weekend. If you connect these apps to its AI features, Google can use its “summaries” and “inferences” for your ads.
Google also says connected data may train its AI and be seen by human reviewers, depending on your settings.
In 2017, it promised your Gmail would never be used for ads. Nine years later, it can.
This is a glaring example of privacy by policy: a company can change what it does with your data at any time, and for its own benefit.
Let's talk about this latest update 🧵
What about Drive? The policy names it but Search can’t connect to Drive yet.
However, Google says more Workspace apps are “coming soon”. When Drive is added and you connect it, the policy already allows information from your files to be used for your ads, depending on your settings.
What can you do?
1. Google Account > Data & privacy > Personalization settings > Manage Personalized Recommendations in Search Services
2. Under Connected Content Apps, disconnect Google Workspace and Google Photos
3. In Gemini, turn off Keep Activity to stop future chats being used for AI training
4. Delete your Search Services History and Gemini Apps activity at activity.google.com
Disconnecting alone doesn’t delete what Google has already saved. Chats already sent for human review can be kept for up to three years.
Here's what changed, what’s unclear, and the full steps, with sources in our latest blog: blog.mega.io/google-gmail-ph…
Watch as @naomibrockwell details how you can move your files from Google Drive to MEGA in just a few clicks 👇
Once they land in your MEGA account, they’re end-to-end encrypted, so only you hold the keys.
Step-by-step guide here: blog.mega.io/how-to-export-f…
Google is reading your Drive.
Your photos, docs, and files are none of their business.
Good news: you can migrate your entire Google Drive to @MEGAprivacy in one click. It’s end-to-end encrypted, so your files are visible to you and no one else — not even Mega.
Couldn’t have said it better ourselves, @naomibrockwell 👇
Moving your Google Drive (or other mainstream cloud services) into MEGA takes a few clicks. No downloading and re-uploading needed and the second your files land they’re end-to-end encrypted. Full guide: blog.mega.io/how-to-export-f…
Google is spying on your drive.
Your photos, docs, & files deserve privacy.
Did you know you can move your entire Google Drive into @MEGAprivacy with a single click? It's E2EE, so only you can see your files. Even Mega can't.
youtu.be/AaXVcAeBjDk
odysee.com/@NaomiBrockwell:4…
📢 MEGA S4 is getting its biggest upgrade yet
MEGA S4 already backs up NAS, media and business archives at petabyte scale. Next, we're aiming for 100,000+ object writes per second and a billion objects, for apps, AI and big backup platforms.
Help us test what’s next: Registration for closed beta access opens soon 🙌
If you have a workload you’d love to bring to S4, this is your chance to test it out. Follow our page to stay posted. More details here
blog.mega.io/mega-s4-q4-2026…
We’ve added Dropbox, OneDrive, and Box to the MEGA migration tool! 🙌
You can now move your files from other cloud services to MEGA in a few clicks: Upload > Import from another cloud service.
With MEGA, your data stays yours, protected by end-to-end encryption by default. So you can keep your files where no service can mine them or train AI on them.
Which cloud storage service are you moving from? 👀
Full blog on how to move your files here: blog.mega.io/how-to-export-f…
Let’s talk about AdFection, because apparently in 2026 not clicking an ad doesn’t mean you’re safe from getting hacked 🙂
Citizen Lab tied zero-click attacks on at least 45 Al Jazeera devices in 2024 and 2025 to Candiru spyware delivered through ads from Discover-Tech, with high confidence. The device only had to load the ad.
Its platform reportedly let customers aim at specific advertising IDs, and ads carrying its script tags showed up in 75,373 apps and 120,768 websites. Nearly 1 in 5 of the bids Citizen Lab analysed appear to carry them.
Google and IAB Europe both listed Discover-Tech as a vendor from 2020 to 2026. The researchers say it “appears to be a front for large-scale ad espionage abuse.” Great vetting work from Google 🙄👏
If loading an ad is all it takes to get hacked, is there any safe way to scroll?
According to Citizen Lab, the script in the ad pings a Discover-Tech server, which apparently checks your IP address and advertising IDs to decide whether you get sent more code. Devices it didn’t pick stay uninfected.
Google has cut Discover-Tech off from its ad exchange platforms and IAB Europe dropped it from its registry in early October. A few other ad platforms have acted too, all after Citizen Lab published.
The lab is also asking regulators to look into whether Discover-Tech and Candiru broke the law.
Full Citizen Lab report here: citizenlab.ca/research/how-d…
It’s 2026, people. You can literally generate strong passwords in one click 🤦
A hacker says password "123456" is all it took to get into Denmark’s national register through an IT contractor’s account, reportedly exposing 8.8 million records. Politiken says at least three of the company’s accounts used it, admin included.
8.8 million records, protected like a gym locker. Nice.
If, for some reason, you also use the weakest password on earth, here's MEGA Pass. It's free mega.io/pass?mct=oct15x
📢 MEGA S4 is now compatible with GoodSync
GoodSync users can now back up and sync from Windows or Mac to MEGA S4's affordable, S3-compatible storage, with 5x free egress.
Here's how to setup MEGA S4 for GoodSync: help.mega.io/megas4/setup-gu…
One word: ads.
Dunkin’s privacy policy says the app may collect precise location and transaction history, and that Dunkin’ “sells” identifiers and transaction history to third parties, including advertising partners.
An app doesn’t need to follow you across other apps and websites to do its job, but some ask anyway.
If an app with no business tracking you asks to track you anyway, tap “Ask App Not to Track” or delete it 🤷
Why does a Discord bot hold this much data? 😳
Double Counter's own privacy policy gives the answer. It links your IP address to your Discord ID to detect alts, and cites GDPR legitimate interests as its legal basis.
Data stays for up to 24 months, and deleting yours only removes your IP while the pseudonymized links between your accounts stay.
That 24 months counts from your most recent detection or verification attempt, so each new one restarts the clock.
So, GDPR gives you the right to erasure but Double Counter's policy also gives itself a retention period that restarts every time you verify. Fun.
Double Counter’s data breach may be much bigger than initially reported, someone in contact with the hacker just sent me more info
The stolen database allegedly contained much more:
-21.7 million verified user records
IP addresses, geographic data, ISPs and Discord usernames
-44.1 million device fingerprint records
14.5 GB of device fingerprint data
-31 million server records
-19.2 million lens-counter records
-14.6 million VPN-attempt records
-831,000 Google user records
~220,000 user emails
~1.08 million Google search records
-A database around 39 GB
>The source also claims Double Counter’s GDPR deletion system did not actually remove all user data.
>According to them, the /privacy deletion command allegedly only removed a user’s current IP, while other information could remain stored, including emails, alternate accounts, their IPs and connections between main and alternate accounts.
>They also claim Double Counter staff deleted messages and banned users who questioned how much data had actually been leaked.
>The source further described an attack chain:
Metabase breach → plaintext password found → same password used on the server → SSH access → logged-in Google Cloud CLI session → access to the cloud environment → database downloaded.
They claim the attackers also obtained secrets, runtime logs and the entire Discord support ticket history.
>One ticket reportedly involved a user warning Double Counter that an ad on its verification page was malicious but the owner refused to remove it because the ad revenue was needed to pay for the servers.
Discord users can't catch a break 🫠
Double Counter, the bot servers used to catch alt accounts, says about 28 million Discord user IDs and usernames and about 27 million IP and location records were at least partly copied and are being treated as exposed.
If you've ever used it on a server, assume you might be in there.
· Look up your email on Have I Been Pwned, which lists about 275,000 (the company says about 1 million were copied, so a clean result doesn't clear you)
· Treat unexpected DMs and server invites like bait, since the company says attackers used its hijacked bot to post their own invite links across about 50 large servers
Double Counter says one vulnerable analytics tool on a forgotten company server was the way in. From there, attackers reached the bot's token and about 12 GB of data.
The irony is Double Counter bot is a server 'protection' bot
A new data breach involving Double Counter has exposed information connected to Discord users affecting around 275,000 unique email addresses.
According to Have I Been Pwned, the exposed data includes:
-Email addresses
-Discord usernames
-Names
-Geographic information
-Country and postcode for some paying subscribers
The breach was linked to a vulnerability in Metabase, the analytics platform used by Double Counter.
If you’ve used Double Counter on Discord, check whether your email was affected and stay alert for phishing attempts or suspicious Discord messages.
