Roku faces second main breach in 2024, this time affecting 576,000 customers

Roku says it discovered one other cyberattack on Friday that affected 576,000 customers. That is the second breach to hit the corporate since March.

Roku says the attackers used account holders' login info, a method referred to as credential stuffing, to achieve entry to some customers' streaming service and fee strategies. The hackers had been then in a position to make use of partial bank card numbers from “roughly 400 circumstances” to make unauthorized purchases for subscriptions to streaming companies and Roku gadgets. However the firm stated the hackers didn’t get delicate info comparable to full bank card numbers and addresses.

The hackers used a technique referred to as credential stuffing, during which malicious actors take stolen usernames and passwords and check out these credentials on totally different companies. Roku says it's potential that third-party sources could have supplied the login info. Hackers used the identical technique in March when 15,000 Roku person accounts had been compromised and bank card info obtained.

Roku says it has reset the passwords for the affected accounts. It can refund or refund costs for any purchases made by the hackers for a small variety of customers whose fee strategies had been used.

The corporate additionally enabled two-factor authentication for all 80 million energetic Roku accounts, even for customers whose info was not a part of the breach. This may ship customers a verification hyperlink to arrange their two-factor authentication. The corporate says requiring further login steps will assist its safety staff “detect and forestall future credential stuffing incidents.”

As all the time, even when your account hasn't been affected by a hack, it doesn't harm to test Have I been held hostage? To allow extra login safety measures.