Another month, another Roku breach

Let me start by saying that I don't really blame Roku for this, but it is a big deal and Roku accounts are impacted. There are two reasons for the breach, and neither is Roku's fault.

The first reason for the breach is truly awful people. Hackers are stealing information and using stolen information to steal more stuff. That's reason one.

Reason two is people making bad decisions. People re-use the same passwords on different services, which is a really bad idea. Yes, it's hard to keep up with different passwords for different things, but suck it up and do the right thing. If I can do it, anyone can do it. Anyway, a lot of people use the same password for everything, and when one of those things gets compromised, the hackers have the passwords to a bunch of other stuff as well. And one of those things is Roku -- for many people that is.

So, what happened is that people got their credentials hacked through some insecure service, and the hackers used the credentials to log into Roku and make purchases through Roku pay, or other credit cards on file.

This happened last month, and now it's happened again, only this time, instead of 15-thousand accounts, over 576-thousand -- over half a million -- accounts were impacted:

Earlier this year, Roku's security monitoring systems detected an increase in unusual account activity. After a thorough investigation, we determined that unauthorized actors had accessed about 15,000 Roku user accounts using login credentials (i.e. usernames and passwords) stolen from another source unrelated to Roku through a method known as "credential stuffing."

Credential stuffing is a type of automated cyberattack where fraudsters use stolen usernames and passwords from one platform and attempt to log in to accounts on other platforms. This method exploits the practice of individuals reusing the same login credentials across multiple services. We concluded at the time that no data security compromise occurred within our systems, and that Roku was not the source of the account credentials used in these attacks.

After concluding our investigation of this first incident, we notified affected customers in early March and continued to monitor account activity closely to protect our customers and their personal information. Through this monitoring we identified a second incident, which impacted approximately 576,000 additional accounts.

There is no indication that Roku was the source of the account credentials used in these attacks or that Roku's systems were compromised in either incident. Rather, it is likely that login credentials used in these attacks were taken from another source, like another online account, where the affected users may have used the same credentials. ...

This is why it's important to have different passwords for different services. Yes, it's hard. So is having stuff stolen. You have a choice as to which pain you want.

My Streaming Life isn't impacted by this, because I use different passwords for everything. I learned the hard way. Take the word of someone who knows: be smarter than the thieves when it comes to your online security.