On FridayRoku confirmed that the cyberattack affected approximately 576,000 accounts. This is the second such cyber attack on the company, which compromised a smaller number of accounts earlier this year.
What’s happening in Rok?
Roku says it detected an “boost in unusual account activity” earlier this year. After review, the company discovered that rogue actors had compromised approximately 15,000 Roku accounts.
However, this was not due to a security breach of Roku’s systems. Instead, these bad actors obtained the usernames and passwords for these accounts through third parties, likely from sources leaking stolen online credentials. They didn’t necessarily know that these usernames and passwords were for Roku accounts; instead, they engaged in so-called “credential stuffing,” an automated process in which they try to log into popular account types using stolen credentials until they hit a winning combination. As it happened, they landed on an initial 15,000 accounts before moving on to bigger winnings.
Roku says it continued its investigation after the incident and discovered another 576,000 hacked accounts. Roku still believes that these accounts’ credentials were taken from somewhere else, and even suggests that they may have been taken from accounts whose users had the same username and password. (Don’t reuse your passwords.) Therefore, the company likely has no security issues at this time.
What should you do if your Roku account is affected
Since Roku has over 80 million energetic accounts, the chances that your account was among the fraction of a percent of affected users are slim. Still, Roku says it has reset the passwords of all users affected by this attack. If bad actors made a payment using your account, Roku refunded your money. The company says no financial information was compromised in the attack, so you can keep your credit cards for now. This also affected a compact number of users (less than 400 cases).
The company has also enabled two-factor authentication (2FA) for all affected accounts. That’s good: 2FA requires access to a trusted device or phone number to complete login after entering your password. Even if your credentials are leaked online, bad actors won’t be able to log into your account without access to, say, your smartphone, greatly reducing the risk of hacking. If you don’t already have 2FA set up on your Roku account (or any account that offers it), remember to do it as soon as possible.
Fortunately, no more users were affected by the attacks, but this incident sheds lightweight on the importance of maintaining digital security. Plain steps like using mighty and unique passwords for all your accounts and setting up 2FA when possible can facilitate prevent your accounts from being hacked.
