Roku has reported that a breach occurred that affected over 15,000 user accounts on its services that revealed sensitive information to the attackers. Putting those account holders at risk for fraudulent charges.
Due to the limited amount of accounts affects (thousands vs millions), the company believes that hackers used information that has already been made available from previous leaks that were due to breaches elsewhere (“third-party services that are not related to Roku”) involving the same username/password configurations. Attackers then use that information to see if the user/pass information is used elsewhere in order to gain access to other services and information. The number one reason why you should never user the same username and password more than once with each website/service.
In some cases, the attackers were able to sign up for various streaming services (ie, Netflix, Disney+, etc) using the credit card information stored on file for those accounts. They also attempted to change account additional information in an attempt to lock the users out of their accounts. Roku said that the attack did not reveal social security numbers, full payment account numbers, dates of birth, or other similar sensitive personal information. Letters were sent out to affected accounts so that users know what happened and how the company is responding to the issue.
The release of this information by Roku comes conveniently right after the company suddenly made a strong push to force its users into updated agreements that limit or prevent their ability to sue the company for any reason (else they wouldn’t have access to their products and services).
