Recently, 15,363 Roku accounts were compromised in a security breach. Cybercriminals accessed sensitive user data, including attempting credit card fraud. Here’s what you need to know:
– The incident was reported to the Maine and California attorneys general on March 8.
– Hackers acquired Roku customer usernames and passwords from an external source and executed a credential stuffing attack.
– The attacks occurred between December 28, 2023, and February 21, 2024.
– Attackers changed account login credentials, locking out legitimate owners and attempting to purchase streaming subscriptions with stored credit cards.
– Roku immediately secured compromised accounts, initiated password resets for affected users, and halted unauthorized subscription sign-ups while refunding all fraudulent charges.
– No social security numbers or sensitive data were compromised in the breach.
To ensure your security:
– Reset your password via the My Roku website.
– Contact support if you experience account access issues.
– Review your account for unauthorized subscriptions or devices that may indicate hacking.
– Check if your data has been compromised on HaveIBeenPwned.
Although the breach impacted only a small fraction of Roku’s user base, caution is advised. It was also discovered that stolen Roku account credentials were being sold online for as little as 50 cents. Culprits even bragged about their exploits on Telegram through screenshots of their fraudulent gains.
Stay safe and secure your accounts!
