Roku has confirmed a second breach affecting 576,000 accounts, some of which have had their credit cards abused.
In March, over 15,000 Roku accounts were hacked in a 'credential stuffing' attack, making this second breach significantly larger. Once again, hackers used credential stuffing.
In the initial breach, some accounts were sold, while others had their credit cards on file misused for purchasing media or hardware such as Roku cameras, remotes, soundbars, or streaming boxes.
In this second breach, approximately 400 users saw unauthorized purchases on their credit cards, according to Roku, who plans to refund the amount.
Improved security
One of the reasons hackers could breach Roku accounts in March was due to weak security and the absence of two-factor authentication, according to a report by BleepingComputer.
Following the recent breaches, Roku has taken steps to improve its security protocols. It has initiated password resets for affected accounts and implemented two-factor authentication for all 80 million Roku accounts, prompting users need to verify through email.
- "While the overall number of affected accounts represents a small fraction of Roku’s more than 80 million active accounts, we are implementing a number of controls and countermeasures to detect and deter future credential stuffing incidents," Roku said in a statement to Variety.
Also read: webOS vulnerabilities affect thousands of LG TVs – update now
The company's new 'Dispute Resolution Terms', which block Roku devices until users agree not to sue the company, are partly linked to the ongoing credential stuffing attacks, according to BleepingComputer's source in March.
- Source: Roku via Variety
