Plex plex.tv Plex data breach 2015: what happened and what to do
In July 2015, the database behind Plex's forums was stolen. Have I Been Pwned lists 327,314 accounts with email addresses, IP addresses, usernames and passwords. Plex has had later, separate incidents that also led to password resets.
View all 13,115 breaches- Breach date
- 2 Jul 2015
- Affected
- 327,314
- Data exposed
- Email addresses, IP addresses, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Plex lets you stream your own movies and music to any screen, and its forums are where owners swap tips. In July 2015, someone stole the database behind those forums. Have I Been Pwned (HIBP), the free breach-tracking service, added it in February 2016 with 327,314 accounts.
What happened
HIBP dates the breach to 2 July 2015. The stolen forum database held details for roughly 327,000 registered users. Reporting on the breach noted that the passwords were protected with salted hashes, but a weak implementation left them open to fast cracking. A hash is a scrambled version of a password, and a weak one can be reversed by guessing at high speed.
That is a different story from the strongest hashing, which makes each guess slow and expensive. With a weak scheme, short or common passwords can fall within hours.
Two later incidents
Plex has been in the news for security problems since. In August 2022, a third party reached a limited subset of account data that included emails, usernames and encrypted passwords, and Plex required a password reset for every account as a precaution. In September 2025, Plex disclosed another incident, again with a mandatory reset, and said it does not store credit card data on its servers.
Those are separate events with their own scope. The HIBP entry and the numbers on this page describe only the 2015 forum database. If you have had a Plex account for years, you may have been involved in more than one.
What was exposed
HIBP lists four data types: email addresses, IP addresses, passwords and usernames.
What that lets criminals do
Passwords are the most valuable item here. Criminals take a cracked email and password pair and try it on other sites, a technique called credential stuffing. If you used the same password for Plex and, say, your email or a shopping account, the 2015 leak is a way in even today. Because the data is ten years old, many people have changed passwords since, but anyone who never did is still exposed.
An email address and username tie your forum activity to your identity, and that makes targeted phishing easier. A message that mentions Plex and your username looks more believable.
IP addresses give a rough location, usually your city or internet provider, but not your street address.
The company's response
Plex required password resets for every account in the 2022 and 2025 incidents. For the details of the 2015 forum breach and any recent notices, check Plex's own security announcements.
Why an old breach still matters
A leak from 2015 never expires. Passwords from it stay in lists that criminals reuse. If any password you set back then is still in use anywhere, replace it now.
What to do if you were in it
- 1
Change your Plex password
Set a unique one from a password manager and turn on two-factor authentication in your Plex account settings.
- 2
Replace every other account that used the same password
Start with your email, then banking and shopping. A leaked password gets tried everywhere. Anything you set up around 2015 and never changed is the first thing to fix.
- 3
Sign out of connected devices
In Plex security settings, sign out of all devices after changing your password. It cuts off any session that someone else holds.
- 4
Expect phishing that mentions Plex
Watch for emails about account problems or password resets you did not request. Go to the website directly instead of clicking a link.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan at serus.ai to see which breaches include your email address or phone number. Serus monitors breach databases and the dark web and alerts you when your data shows up, so you hear about the next one early. It can't remove data from breach dumps, which is why the other steps here matter.
Frequently asked
Was I affected by the Plex data breach?
HIBP lists 327,314 accounts from the 2015 forum breach. Search your email on Have I Been Pwned or run a free Serus scan. You may also have been involved in later Plex incidents.
What was exposed in the Plex breach?
Email addresses, IP addresses, passwords and usernames.
Were the passwords protected?
They were stored as salted hashes, but reporting says the implementation was weak and left them open to quick cracking. Treat them as compromised.
Should I change my password?
Yes. Change your Plex password and any other account that shares it.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
