Roku roku.com Roku data breach: what happened and what to do
Roku told regulators in March 2024 that attackers got into 15,363 accounts between late December 2023 and February 2024 using passwords stolen from other sites. Some accounts were used to buy subscriptions and hardware.
View all 13,115 breaches- Breach date
- 28 Dec 2023
- Affected
- 15,363
- Last updated
What happened
Roku disclosed in March 2024 that attackers had accessed 15,363 customer accounts. This wasn't a break-in at Roku itself. Attackers took username and password pairs leaked from other services and tried them on Roku logins, a method called credential stuffing. It works on anyone who reuses a password.
The activity ran from December 28, 2023 to February 21, 2024, according to the notices Roku filed with state attorneys general in March 2024. In some accounts the attackers changed the login details to lock the owner out and used a stored payment method to buy streaming subscriptions and Roku hardware. BleepingComputer reported that hijacked accounts were being sold for about 50 cents each.
Roku reset the passwords on affected accounts, cancelled unauthorized subscriptions and refunded charges, according to press coverage of the notices. Roku didn't offer two-factor authentication when this came to light, which critics pointed out.
What this means for you: if your Roku account was hit, someone else may have seen the name, email and address on the account. The bigger risk is the password. If you used the same one elsewhere, those accounts are open to the same trick.
What to do if you were in it
- 1
Change your Roku password
Pick one you don't use anywhere else. A password manager makes that painless.
- 2
Change reused passwords
Any other account that shares the old password needs a new one, starting with email and banking.
- 3
Check charges and subscriptions
Look at your Roku account for subscriptions you didn't add and your card statement for purchases you don't recognize. Dispute them with your card issuer.
- 4
Turn on 2FA wherever it's offered
Two-factor authentication stops a stolen password from being enough on its own.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It checks breach databases and the dark web for your email and phone number and tells you what to do next.
Frequently asked
Was I affected by the Roku data breach?
Roku said it notified the owners of the 15,363 affected accounts. If you got a notice or a forced password reset in early 2024, you were likely one of them.
Should I change my password?
Yes, and change it on any other site where you used the same one.
Was Roku itself hacked?
Roku's notices describe credential stuffing, where attackers used logins stolen from other services, not a breach of Roku's own systems.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
