Roku activates 2FA for 80M users after breach of 576K accounts
Streaming TV service provider Roku activated two-factor authentication (2FA) for all its 80 million users after hackers compromised 576,000 accounts in a credential stuffing attack.
It is the second credential stuffing incident the company has disclosed this year, although it said “sensitive” customer information — including full credit card numbers — was not stolen in either attack. The first breach, affecting more than 15,000 accounts, was disclosed last month.
Credential-stuffing attacks involve hackers attempting to log into services using acquired lists of usernames and passwords unrelated to the target. It can be an effective way to breach a significant number of accounts on popular consumer service portals given many subscribers use the same username and password combination to access multiple services.
