We thought Taylor Wessing had made a manual mistake, and we were wrong. It is a firm-wide automated catastrophe affecting Pfizer, Just Eat, SAP, Chubb and Valve.
Systemic Vulnerability Advisory
My Dog vs. Elite Lawyers (Part 2): The 5-Year PDF Vulnerability Exposing Global Corporations
On this page
We thought Taylor Wessing made a manual mistake with a GDPR request. It turned out to be an automated, firm-wide catastrophe.
🚨 Key Findings:
The Breach: Elite law firm Taylor Wessing is using an outdated script to "redact" sensitive PDFs, masking data visually but leaving the text fully readable underneath.
The Scale: Evidence suggests this vulnerability has affected their corporate clients (including giants like Pfizer, Just Eat, Chubb, and SAP) since 2019.
The Hypocrisy: While leaking massive amounts of data, their lawyers issue baseless criminal threats to citizens making lawful GDPR requests.
A few days ago, as a spin-off to our massive cybersecurity exposé on How Valve Profits From 70M+ Stolen Steam Accounts, we published an article documenting a catastrophic legal blunder.
We revealed how the elite, high-priced lawyers at Taylor Wessing (specifically Dr. Patrick Zurheide and Dr. Tobias Schelinski) accidentally leaked 830 pages of highly sensitive, de-anonymized Steam user data while trying to defend Valve against a routine GDPR request.
We joked that my dog, having precisely zero data breaches on her resume, was officially better at data protection than a Salary Partner with a PhD in IT Law.
My dog is now winning 2–0.
After publishing the first piece, we had a long, hard look at those 830 pages of black rectangles. We realized something fundamental about corporate lawyers: they are generally too self-important to manually draw black boxes on 800+ pages. Doing that by hand would give you a severe case of digital hemorrhoids.
No, they didn't do it manually. They used a script. And that's when the joke stopped being funny, and became a systemic, global cybersecurity crisis.
The Cheap Software Behind the Elite Facade
Now for the technical reality of what these lawyers (who think they are richer, smarter, and more important than Valve's own users) actually did.
To save money on proper, enterprise-grade data sanitization software, their systems rely on a generic, outdated library: Aspose.PDF for .NET 20.8.
The core issue is that their script uses this outdated software to draw black vector rectangles (using re/f operators in the PDF code) over text coordinates. What it should be doing is properly sanitizing and deleting the underlying text layer (using BT/ET operators).
It creates a visual mask on your screen, but the raw data remains 100% accessible beneath it.
Let's do the math on the scale of this catastrophe. Dr. Patrick Zurheide alone likely processes roughly 100 to 300 GDPR requests a year. For the few users who don't immediately surrender to his initial wave of legal threats and delays, he eventually sends them the "brilliance of his experience": a legal response document that consists of 94% black rectangles.
Malevich painted a "Black Square".
This one is just a cheap vector shape. Remove it.
The Blast Radius: Whose Data Did Taylor Wessing Process?
Rather than guess that this was a firm-wide issue, we tested it.
We immediately contacted individuals we knew who had previously received documents processed by Taylor Wessing. They sent us their files. We opened them and looked straight at the meta-tags. We found what we expected: the exact same vulnerability and the exact same flawed redaction script.
We did not read the contents of their hidden documents. We absolutely refused to look at the underlying data. We simply checked the metadata, confirmed the vulnerability, and handed the owners the instructions on how to reveal the hidden text themselves.
But let's scale this up. This vulnerability has likely been present in hidden documents processed by Taylor Wessing since 2019. Now, think about the corporate giants they defend.
Taylor Wessing proudly advertises its Data Protection and Cyber Security work for massive global corporations. Based on their own public client lists and our forensic findings, we have to ask a terrifying question regarding the data they have processed over the last five years:
- What about the millions of gamers in the Valve (Steam) ecosystem?
- What about the global GDPR compliance documents of Just Eat?
- What about the European data transfers for tech giants like Vinted and SAP?
- What about the sensitive incident reports for Chubb Insurance (where Taylor Wessing ironically boasts about sitting on their "Cyber Incident Response Team")?
- And what about the highly confidential clinical data handled by Pfizer and their other Life Sciences clients?
If Taylor Wessing used this same cheap script to "redact" documents for these corporations, then they didn't hide anything. They intentionally disclosed it.
The Difference Between Us: A Message to Taylor Wessing
Let's address Taylor Wessing directly. What is the fundamental difference between your actions and ours?
You, Dr. Patrick and Dr. Tobias, are utterly arrogant. You threaten your clients and opponents with criminal code articles. You act like God. You arbitrarily hand out permanent account bans simply because a user's burner email address doesn't explicitly contain their real name. You act as the judge, the jury, and the executioner.
We do not blackmail. We do not suffer from a God complex. And we don't just write articles. We do not decide which criminal articles apply; the courts and the regulators do. But apparently, at Taylor Wessing, you operate under the delusion that lawyers write the laws and pass the verdicts.
ATTENTION TO ALL CORPORATE CLIENTS: This avalanche cannot be stopped: the data is already out there, emailed from Taylor Wessing's own servers. You should say a massive "thank you" to Dr. Patrick, Dr. Tobias, and their accomplices for single-handedly compromising your confidential documents.
📎 SECURITY ADVISORY: We Warned Them. Now It's Up To You.
We have already contacted Taylor Wessing and informed them of this critical vulnerability. But let's be realistic: we know they are liars.
We fully expect them to lie, hide the truth, and bury this under attorney-client privilege, because the scale of this data leak is undeniably critical. If you or your company have ever received a "redacted" PDF document from Taylor Wessing, audit these files immediately.
⚡️ No-Install Lifehacks (The Easiest Ways to Check)
- The "Select All" Hack: Open the PDF in your browser. Press Ctrl+A (Select All), then Ctrl+C (Copy), and paste it (Ctrl+V) into Notepad. If the redaction is fake, the "hidden" text will simply paste right along with the rest of the document.
The "Blind Search" Hack: Press Ctrl+F and search for common characters (like the vowel "a" or the number "1"). If the browser registers a hit and highlights the black redaction box, the text layer is still alive.
🛠 How to Check Visually (Safe Offline Software)
LibreOffice Draw: Open the PDF, click the black box, and press Delete.
Adobe Acrobat Pro: Use the "Edit PDF" tool to simply drag the black shapes out of the way.
⚠️ WARNING: Do NOT upload sensitive legal documents to random online PDF editors like ilovepdf. You might be committing a data breach. Only use local software.
Do Not Let Them Hide This
We are not willing to take on the burden of responsibility, nor will we act as free cybersecurity janitors to cover up the crimes of a massive law firm that exists to threaten and intimidate citizens in the interests of mega-corporations.
If you discover that your data (or your opponent's data) was left exposed by Taylor Wessing's fake PDF redactions, do not wait for them to contact you. They won't.
We contacted Patrick, and apparently, he thought he was the smartest guy in the room. In response to our message about the data leak, he seemed to think we were going to chat with him, and he simply called it 'amusing.'
There will be no further communication between PhishDestroy and Taylor Wessing. We have notified them about the leak via their official emails. However, judging by Patrick's reaction, 'amusing' means that no one is going to take any action or notify anyone.
Because of this, we have created a tool so you can check and report it yourselves. It can be run locally without an internet connection, and there are no logs. It works for this specific case and for any similar ones. Let's just hope there aren't any more 'amusing' lawyers out there besides these guys.
https://phishdestroy.github.io/taylor-wessing-data-breach-toolkit/
Remove the black square, read the truth, and immediately report the data leak to your national Data Protection Regulator.
And if you want to share your confirmed leaks with us (complains@phishdestroy.io), we will gladly forward them to the universities where these "experts" give lectures. We are certain they have nothing of value to teach students, except perhaps a masterclass in arrogance and issuing empty threats.
They will inevitably call us "black-hat hackers." They will likely issue PR statements claiming they are "cooperating with law enforcement." Funny, isn't it?
Apparently, the law applies differently to them. They are the ones who leaked the data of minors. They are the ones who put children's lives in digital and physical danger through their sheer incompetence. Yet, they operate under the delusion that they are the law.
They don't hesitate to issue direct criminal threats, labeling anyone associated with a lawful GDPR request as "accomplices" (a direct formulation from Dr. Patrick Zurheide's official response). To the corporate giants reading this: this is who you trust with your clients' data. You are paying premium rates to absolute amateurs who treat a fundamental GDPR data request like an aggressive debt collector's call or a hostile corporate attack.
People with this mentality have no business working in Tech and IT Law. They twist European legislation to suit their arrogance, and to make matters worse, they are allowed to teach at EU universities. With clowns like this gatekeeping data protection, EU citizens effectively have no rights. They use the very laws designed to protect you as a weapon to threaten you.
Let us remind Dr. Patrick and his "accomplices" of one simple fact: We do not blackmail, and we do not suffer from a God complex. We do not decide which criminal articles apply, and neither do you. The courts and the regulators do.
PhishDestroy Research Team (and the Dog)
About PhishDestroy
PhishDestroy is an independent cybersecurity research initiative dedicated to dismantling criminal phishing infrastructure, exposing corporate data breaches, and holding tech giants accountable for user safety. We accept no donations. We rely entirely on forensic facts.
LICENSE · RIGHTS · DISCLAIMER
PHISHDESTROY
LICENSE · RIGHTS · DISCLAIMER
Investigation: Valve Corporation / Steam · public — no expiry date, no take-backs
MIT PUBLIC DOMAIN OFAC-RESTRICTED
SECTION I — LICENSE
PhishDestroy gives up every right to this material. Zero. Gone. Done. You can reproduce it, sell it, put your name on it, tattoo it on your boss, whatever. No credit required, no DM needed, no thank-you card expected.
ONE ACTUAL RULE
If you are a user from Russia or any OFAC-sanctioned country — this material is NOT for you. No loopholes. Enjoy your sanctions. And if you switched your Steam region to Turkey while sitting in Moscow — congratulations on your creative geography. You're still Russian. The sanctions still apply. That's literally the point.
SECTION II — WHAT THIS IS AND WHY IT EXISTS
We will publish more about Valve than an average Valve employee knows about themselves. Steam basically created us. It raised us on its scammers, its support tickets, its ban evasion ecosystem — and here we are. No hard feelings. Poetic, actually. We waited over 4 years for them to fix the spoofing issue before we could write about it publicly. Is this a conflict? No. Can it be resolved? Yes. But we're not signing any NDA and we're not playing bug bounty for pennies.
SECTION III — OPEN LETTER TO VALVE
Valve: if you want this domain taken down, email us. Outside counsel is not needed for that conversation.
Will we damage Valve directly? Probably not in a way they'll feel fiscally. We're not delusional. But we will do it honestly, openly, without chasing clout. We have 5 years of archives. Regulators get the originals. Researchers and journalists get redacted versions. PhishDestroy is a community, not a person.
THE DEAL (open offer, no lawyers needed)
If you want the domain gone: let your IT law professionals calculate the price. 50% goes to the SEAL Foundation. We kill the domain. No drama. No court. Done. You won't get it any other way. This is not a threat. It is just the architecture of the situation.
SECTION IV — THE MONEY, THE BANS, THE WHOLE CIRCUS
Here's the thing about Steam banning gambling sites and scammers: it's not enforcement. It's revenue capture. Valve pockets the money, cleans its hands, then goes on stage and tells everyone a wholesome story. Meanwhile Valve killed the ability to properly track skins in 2017. We are going to prove it: skins are more anonymous than Monero. A Peruvian cartel allegedly used Dota 2 skins for money movement. Steam is functionally a sanctions-bypass machine worth about $7 billion in "trading cards".
SECTION V — THE MALWARE THING
We are not disclosing the vulnerability in the game publicly, and we are not filing it through Steam's bug bounty. The programme requires an NDA, and signing one would bar us from telling affected users what happened to their accounts. Our security colleagues have already reported it to Steam support. This is NOT the trivial CSGO variant. It is closer to: RCE on server connect. As in — you join a server, you don't click anything. The connect itself is the attack surface. The threat is active.
DECLARATION AS TO USE AND RIGHTS
PhishDestroy Project & Cybersecurity Coalition
1. THERE ARE NO CONDITIONS ON USE
All material produced by the Coalition in this referral — the statements of fact, the analysis, the exhibits, the tooling and the findings — is released WITHOUT RESERVATION OF ANY RIGHTS. Anyone may reproduce it, adapt it, edit it, rewrite it, translate it, excerpt it, incorporate it into official documents, present it as their own work or pass it on to anyone else — without asking and without notifying the Coalition.
2. WHY THIS MATTERS PRACTICALLY
There is nothing here to be entangled with. The Coalition asks for nothing, is owed nothing, retains nothing, and has no expectation of any kind. An authority using this material is not acting for the Coalition. It is using public information that happens to have been assembled by someone else.
3. EVERYTHING IS OPEN ALREADY
The investigations are published openly at phishdestroy.io. The tooling is published as open source under the MIT licence at gitlab.com/phishdestroy. The methodology is set out in the referral. The Coalition accepts no donations and has published that position since 2018.
4. INTEGRITY OF THE EVIDENCE BUNDLE
Each delivery is accompanied by a file SHA256SUMS listing a SHA-256 digest for every file supplied, together with a detached OpenPGP signature SHA256SUMS.asc. The signing key is published at phishdestroy.io/.well-known/pgp-key.txt and on keys.openpgp.org.
5. ON REGISTER
The authority may encounter the Coalition's published investigations and find them blunt, adversarial and at times satirical. That impression is correct. The Coalition writes that way deliberately. The waiver is the mechanism by which the substance can be separated from the register: the authority may take what is useful, restate it in its own voice, and discard every word of the Coalition's manner. Nothing is lost by doing so.
6. WHAT THE COALITION IS PROVIDING
Information, research and observation. Nothing is asserted as a finding that the Coalition has no standing to make. The Coalition seeks no remedy, no payment, no acknowledgement and no outcome for itself. It asks only that the questions set out in the referral be put to Valve Corporation by a body with the power to compel an answer.
CLOSING NOTE — TO WHOEVER IS CARRYING THIS FORWARD
We want to thank whoever gets this material to where it needs to go. Valve has deep pockets and Taylor Wessing charges by the hour. We know what we're doing. We know who we're writing about. We don't need authorship. We don't need attribution. We don't need a win. We need someone with actual authority to ask Valve the questions that are already sitting in this referral, with the power to require an answer. That's it. That's the whole ask.
PhishDestroy — public investigation — all rights surrendered to humanity · OFAC-region access: prohibited
Additional editorial notes
┌─────────────────────────────────────────────────────────────────────────┐ │ THE DEAL (open offer, no lawyers needed) │ │ │ │ If you want the domain gone: │ │ let your IT law professionals calculate its price. Take your time — │ │ it is a rare asset: the only website in the world whose purchase │ │ changes nothing, because everything on it already lives on IPFS, │ │ in regulator inboxes, and in archives we do not control. │ │ │ │ 50% of whatever you pay goes to the SEAL Foundation │ │ (securityalliance.org) — people who do volunteer security work │ │ professionally and publish it for free. We are not affiliated with │ │ them and they did not ask for this; we name them as the public │ │ standard of what real volunteers look like — the standard your own │ │ volunteer moderators and outsourced support failed, publicly, │ │ before you had to remove them. You know the scandals. So do we. │ │ │ │ The rest buys the community coffee while we keep publishing. │ │ That is not a settlement offer. It is a demonstration of what │ │ money can't reach: the domain is the maximum Valve can obtain, │ │ and obtaining it obtains nothing. The referrals continue. │ │ The mirrors continue. Part 3 continues. │ └─────────────────────────────────────────────────────────────────────────┘
┌─────────────────────────────────────────────────────────────────────────┐ │ ONE ACTUAL RULE (yes, just one) │ │ │ │ Access from OFAC-sanctioned jurisdictions is prohibited. That is a │ │ matter of territory and law — not of nationality and not of people. │ │ Changing your Steam region does not change your physical location │ │ or your legal status. No loopholes. │ └─────────────────────────────────────────────────────────────────────────┘