Hackers Steal Almost 600,000 Account Records of Streaming Service Giant Roku

Back in March, Roku emailed a statement to AARP that said its “security team recently detected suspicious activity that indicated a limited number of Roku accounts were accessed by unauthorized actors using login credentials obtained from third-party sources (e.g., through data breaches of third-party services that are not related to Roku).” Roku added that, “in response, we took immediate steps to secure these accounts and are notifying affected customers.” 

As part of that investigation, the company determined that once gaining access to the stolen account credentials, the criminals “changed the Roku login information for the affected individual Roku accounts, and in a limited number of cases, attempted to purchase streaming subscriptions.”

No Social Security numbers, birth dates imperiled, Roku says

Roku claims that the hackers were not able to access customer Social Security numbers, full payment account numbers, dates of birth or other sensitive personal information. It also says it is continuing to monitor for signs of suspicious activity.

The company reset passwords on any accounts where evidence suggested those accounts were part of the breach. To log in after a company password reset, go to my.roku.com and use the Forgot password? option on the sign-in page.

Roku is refunding or reversing the charges on accounts where hackers purchased streaming subscriptions or Roku hardware.

“We also want to reassure customers that these malicous actors were not able to access sensitive user information or full credit card information,” Roku said.

Roku has more than 80 million active accounts, so the number of consumers apparently affected is less than 1 percent. Still, given this latest announcement, customers should not assume they evaded the crack in Roku’s security.

What can you do?

As always, practice robust digital security hygiene.

Create strong passwords that are not repeated across any of your other online accounts. Roku recommends a mix of at least eight characters, including numbers, symbols, and upper- and lower-case letters.

Review the subscriptions and devices linked to your Roku account, which you can see on your account dashboard. Periodically review statements for all your accounts.

Remain vigilant and report any suspicious activity to Roku and other companies you do business with.

Contact Roku with questions about the incident by calling 816-272-8106 or emailing account-help@roku.com.

Consider obtaining your credit reports from one or more among Equifax, Experian and TransUnion. You can also obtain a free credit report online at annualcreditreport.com or by calling 877-322-8228.

Think about a credit freeze on your file to prevent new credit cards from being opened in your name.

Report other suspicious activity to the Federal Trade Commission, your state’s attorney general office or law enforcement.

This story, originally published March 12, 2024, has been updated with the news of a second Roku breach.