Roku Says Nearly 600,000 Accounts Were Taken Over by Hackers

Roku has disclosed a significant incident of unauthorized access to its user accounts, impacting a relatively small fraction of its over 80 million active accounts, estimated to be roughly 600,000.

Earlier this year, Roku's security team noticed an uptick in suspicious account activities, which upon investigation, revealed that approximately 15,000 user accounts had been compromised through credential stuffing.

This form of cyberattack involves hackers using stolen usernames and passwords from other platforms to access accounts on different services. Roku confirmed that the compromised credentials were not stolen from its own systems but from other sources, indicating that the affected users likely reused their login details across multiple platforms.

A subsequent discovery was made during continuous monitoring for anomalous activities, which led to identifying a second breach affecting around 576,000 additional accounts. In fewer than 400 of these cases, unauthorized transactions were made, including purchases of streaming services and hardware. Fortunately, sensitive information such as full credit card details was not accessed.

Protecting Roku accounts

In response to these breaches, Roku has taken several steps to secure user accounts and prevent future incidents:

• Password Resets: Passwords for all affected accounts have been reset, and Roku is directly notifying the impacted customers.
• Refunds and Reversals: Charges made during the breach are being refunded or reversed.
• Enhanced Security Protocols: Roku has enabled two-factor authentication (2FA) for all accounts, adding an additional layer of security. When users attempt to log into their Roku account online, a verification link will now be sent to their associated email address, which must be clicked to access the account.

Users are encouraged to take proactive steps to secure their accounts, such as:

• Creating robust and unique passwords for their Roku accounts, incorporating a mix of characters, numbers, and symbols.
• Remaining alert to any suspicious communications that might appear to be from Roku, especially those asking for personal details or payment information.
• Regularly check their email for communications from Roku and periodically review account charges.

Roku expressed deep regret over the incidents and any inconvenience they may have caused, but it should be noted that the responsibility to secure accounts burdens users, too, who shouldn't be recycling passwords across online platforms and services.