15,000+ Roku Accounts Hacked and Sold Online

Over 15,000 Roku accounts have been compromised, which has resulted in hackers gaining unauthorized access to sensitive information, including credit card details. The breach occurred between December 28, 2023, and February 21, 2024.

Roku confirmed the breach, stating that the hackers employed a technique known as credential stuffing, where previously exposed emails and passwords from unrelated breaches were used to gain unauthorized access to Roku accounts. The same tactic was employed by hackers to breach the pet retail giant PetSmart just last week.

"Hackers likely obtained account information exposed in previous data breaches of third-party services," Roku mentioned, further highlighting the method of attack.

Once the hackers gained access to a Roku account, they altered the login details, effectively locking out the legitimate owner. BleepingComputer further uncovered the impact of the breach, revealing that the stolen accounts allowed cybercriminals to use stored credit cards to make fraudulent transactions, including the purchase of streaming subscriptions and Roku devices. According to The Verge, the compromised accounts were also being sold on a hacking marketplace for as little as 50 cents each.

In response to the breach, Roku has taken steps to mitigate the damage by securing the affected accounts and forcing a password reset. The company has also been working to cancel and refund any unauthorized purchases made during the breach.

The incident has highlighted the absence of two-factor authentication for Roku accounts, a security measure that could potentially have prevented such unauthorized access. Users are requested to reset their passwords for Roku accounts immediately and closely monitor their credit card transactions for any unauthorized activity.

To mitigate the risk of credential stuffing attacks, ensure that each of your online accounts uses a strong, unique password. Then, even if the credentials for that account are exposed, the same password cannot be used to gain access to your other accounts.