Roku, a popular streaming service provider, has revealed a second data breach affecting over 576,000 user accounts.
This news follows the discovery of an earlier breach impacting 15,000 users earlier in 2024.
Reassuring its user base of over 80 million active accounts, Roku clarified that hackers did not gain access to sensitive information like complete credit card numbers.
However, in a limited number of cases (under 400), attackers used stolen login credentials to make unauthorized purchases using the stored payment methods on these accounts.
Roku has pledged to reimburse or reverse any unauthorized charges resulting from this attack.
Investigators suspect the attackers employed “credential stuffing,” a technique where stolen login credentials from other platforms are used to gain access to Roku accounts.
To bolster security measures, Roku has now made two-factor authentication mandatory for all accounts.
