MiHoyo is a Chinese company that has recently produced the hugely popular online game, Genshin Impact. However, terrible online security has led to thousands of user details, emails, phone numbers, and the accounts themselves being hacked and leaked.
Firstly, MiHoyo states in their ToS that the user is responsibly for their account security. https://genshin.mihoyo.com/en/company/terms
You shall be responsible for keeping your Account secure and confidential (including but not limited to usernames, passwords or other related account information). Also, you acknowledge that you shall be responsible for any and all behaviors performed and identified on or through your Account, whether or not authorized by you.
But at the same time, it is MiHoyo's fault for allowing the security vulnerability to exist. Therefore, is it possible to file a GDPR complaint? Or does the ToS override this?