Roku customers endure another cyberattack
FBI warns Chinese hackers preparing to ‘wreak havoc’ on Americans
FBI Director Christopher Wray testifies before the House Select Committee on the Chinese Communist Party.
Recently, Roku has faced significant security challenges, with two separate cyberattacks occurring within a short span.
The streaming giant confirmed that over half million Roku user accounts were compromised through credential-stuffing attacks in a second incident.
Man using a Roku remote (Roku)
What happened: A breakdown of the incidents
The first of these incidents was detected earlier this year when Roku's security systems noticed unusual activity in about 15,000 user accounts. Investigations revealed that these breaches were due to credential stuffing, where attackers used login information stolen from other services to access Roku accounts. Fortunately, Roku confirmed that there was no compromise of their systems and the credentials used were obtained from external sources.
The situation escalated with a second, larger-scale incident involving approximately 576,000 accounts. In fewer than 400 of these cases, malicious actors logged in and unauthorized purchases of streaming service subscriptions and Roku hardware products were made. However, sensitive user information, including full credit card numbers or other full payment information, remained secure.
Roku has over 80 million active accounts, and the affected accounts represent a small fraction of their user base. The company posted a statement on its website, saying, "We sincerely regret that these incidents occurred and any disruption they may have caused. Your account security is a top priority, and we are committed to protecting your Roku account."
Roku website (Roku)
MORE: HOW TO FIND OUT WHO'S SPYING ON YOU
Roku's proactive measures
In response to these security breaches, Roku has taken four proactive steps.
1. Password Resets: All affected accounts have had their passwords reset.
2. Direct Notifications: Roku has been notifying affected customers directly.
3. Refunds and Reversals: Charges made during the breach are being refunded or reversed.
4. Two-Factor Authentication: Roku has rolled out two-factor authentication (2FA) for all accounts to provide an additional layer of security.
NATIONWIDE ALERT: SMS PHISHING ATTACKS TARGET TOLL ROAD CUSTOMERS
Roku website (Roku)
MORE: HOW TO PROTECT YOURSELF FROM STREAMING HACKS
How you can help protect your account
Roku emphasizes the importance of user participation in securing accounts. Here are a few recommendations:
- Strong, Unique Passwords: Users are urged to create robust passwords that are unique to their Roku accounts. You might want to consider using a password manager to generate and store your passwords securely.
- Vigilance: Roku advises users to be vigilant against suspicious communications and to contact customer support if unsure about the authenticity of a request.
- Stay Informed: Users should regularly check their emails for communications from Roku and log into their accounts to review charges.
What to do if you’ve been hacked
If it has already happened, and you’ve been hacked, then you should take immediate action to minimize the damage and secure your device. Here are some steps that you can follow.
Change your Roku passwords
If hackers have recorded your passwords, they could access your online accounts and steal your data or money. ON ANOTHER DEVICE (i.e., your laptop or desktop), you should change your passwords for all your important accounts, such as email, banking, social media, etc. You want to do this on another device so the hacker isn’t’ recording you setting up your new password on your hacked device. And you should also use strong and unique passwords that are hard to guess or crack. You can also use a password manager to generate and store your passwords securely.
Enable two-factor authentication: Two-factor authentication prevents credential-stuffing attacks by adding an additional layer of security to your Roku account. It works by prompting you to enter a time-sensitive code along with your username and password. This prevents hackers from breaking into your account with just a stolen password.
Monitor your accounts and transactions
You should check your online accounts and transactions regularly for any suspicious or unauthorized activity. If you notice anything unusual, report it to the service provider or authorities immediately. You should also review your credit reports and scores to see if there are any signs of identity theft or fraud.
Use identity theft protection
Identity Theft protection companies can monitor personal information like your home title, Social Security Number, phone number and email address and alert you if it is being used to open an account. They can also assist you in freezing your bank and credit card accounts to prevent further unauthorized use by criminals.
One of the best parts of using an identity theft protection company is that it could include identity theft insurance of up to $1 million to cover losses and legal fees and a white-glove fraud resolution team where a U.S.-based case manager helps you recover any losses. See my tips and best picks on how to protect yourself from identity theft.
Contact your bank and credit card companies
If hackers have obtained your bank or credit card information, they could use it to make purchases or withdrawals without your consent. You should inform your bank and credit card companies of the situation. They can help you freeze or cancel your cards, dispute any fraudulent charges and issue new cards for you.
Alert your contacts
If hackers have accessed your email or social media accounts, they could use them to send spam or phishing messages to your contacts. They could also impersonate you and ask for money or personal information. You should alert your contacts and warn them not to open or respond to any messages from you that seem suspicious or unusual.
Hacker on a laptop (Kurt "CyberGuy" Knutsson)
MORE: HACKERS USE PIRATED SOFTWARE TO HIJACK MAC, ANDROID AND WINDOWS DEVICES
Kurt's key takeaways
Roku's recent experiences highlight digital service providers' ongoing challenges in securing user data against increasingly sophisticated cyberthreats. By implementing stronger security measures and fostering user awareness, Roku aims to safeguard against future incidents. The adoption of two-factor authentication is a significant step forward, ensuring that the security of user accounts is not solely dependent on passwords.
How has the recent surge in cyberattacks affected your trust in digital platforms, and what actions should companies take to regain your confidence? Let us know by writing us at Cyberguy.com/Contact.
For more of my tech tips & security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter.
Ask Kurt a question or let us know what stories you'd like us to cover.
Answers to the most asked CyberGuy questions:
- What is the best way to protect your Mac, Windows, iPhone and Android devices from getting hacked?
- What is the best way to stay private, secure and anonymous while browsing the web?
- How can I get rid of robocalls with apps and data-removal services?
Copyright 2024 CyberGuy.com. All rights reserved.
Kurt "CyberGuy" Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on "FOX & Friends." Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.
