All files that Zotac customers uploaded via the manufacturer’s website were publicly available via Google. The Gamers Nexus YouTube channel discovered this. This includes RMA applications, where customers’ personal information can be found.

Zotac stored files uploaded to its site on Google’s public web servers, making them searchable, Nexus players saidAccording to the YouTube channel, using a search query like “site:zotacusa.com rma,” it was possible to download and view customer return requests. These files included email addresses, phone numbers, and home addresses, which were therefore publicly available. Payment methods and the last few digits of credit cards could also be seen in some of these apps.

In addition to RMA applications, several other documents were found in this way. Invoices from business customers were also stored in this way. Gamers Nexus also found customer service chat logs, screenshots of Amazon orders, and electrical schematics from PC Partner, Zotac’s parent company. The YouTube channel speculates that every file that customers send to the manufacturer via the upload button on Zotac’s website is stored publicly.

Gamers Nexus reported the issue to Zotac. The company stopped the leak shortly after. While the links can still be found on Google, they now result in an error message. The hardware manufacturer has also temporarily removed the download button from its website until a permanent fix is ​​found.