Streaming TV provider, Roku, has confirmed that over 576,000 customers have been affected by a data breach.
These accounts were accessed through “credential stuffing”
Credential stuffing is a type of automated cyberattack where fraudsters use stolen usernames and passwords from one platform and attempt to log in to accounts on other platforms. This method exploits the practice of individuals reusing the same login credentials across multiple services.
Roku says they identified two instances where this occurred. They notified about 15,000 customers in early March and kept monitoring for any suspicious activity. The second time around is where they discovered an additional 576,000 accounts had been affected.
Through investigation, the company concluded that Roku’s systems were not compromised and no sensitive information, i.e. credit card info, was taken from people. They say login credentials were stolen from another source and then used on Roku’s login site.
In less than 400 cases, malicious actors logged in and made unauthorized purchases of streaming service subscriptions and Roku hardware products using the payment method stored in these accounts, but they did not gain access to any sensitive information…
To keep their 80 million users safe, Roku has implemented a two-step authentication, so when you login an e-mail with a link to click on will be sent to the associated account. All passwords were reset for those who were affected by the breach and refunds were made for the unauthorized purchases.
For more info on how to keep your account secure, click for Roku’s suggestions.
