how it happened
- whoattackersreused password lists
- the gapRoku accountsno second factor
- the result~591,000 accountssome used stored cards
what everyone assumed
A streaming account holds a watchlist and some preferences, so the quiet reasoning goes that there is little worth stealing and little reason to force a second factor on every customer. It is a reasonable read of the risk. The threat model that says “what is the worst someone could do here” tends to stop at the visible value of the account, which for a TV login looks small.
what happened
Attackers worked through lists of email-and-password pairs leaked from older, unrelated breaches, trying them against Roku one at a time. Most failed. Around 15,000 accounts opened in the first wave because the people behind them had reused a password that was already circulating. The technique was unremarkable, and each successful login looked, by the system’s own measure, like a customer signing in. Then it happened again, at larger scale.
step by step
- old leaked passwords are tried against RokuMost fail.
- about 15,000 accounts openTheir owners had reused passwords.the assumption breaks here
- a second wave reaches about 576,000Fewer than 400 see purchases with stored payment methods.
- two-factor turned on for all accounts
how it surfaced
The first wave reached roughly 15,000 accounts. The second reached around 576,000. In fewer than 400 of those accounts, the people inside used a stored payment method to buy streaming subscriptions and Roku hardware. Roku found no evidence its own systems were the source of the credentials. After the second wave, the company enabled two-factor authentication across all accounts.
The thing worth stealing was never the watchlist.
It was the stored card behind it and the login itself, and a reused password reached both before any second factor existed to ask a question.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersAttackers log in with leaked passwords and buy things with the saved cards.what it costs youCustomers blame you, and you turn on two-step login after the damage.
- or it goes like thisit happened23andMe, 2023howLeaked passwords are tried against customer accounts until some open.what leavespersonal details of customers and their contactswho ends up with itfraudsters
- or it goes like thisit happenedThe Snowflake wave, 2024howAn old password opens a data store that never required a second step.what leavesthe whole database in one downloadwho ends up with itan extortion group
sources
your turn
what you can do about it
this week
Pick the account type you have decided is not worth protecting and trace what it can actually reach: stored cards, connected services, the password reuse it shares with someone's email.
Your product has accounts you have quietly filed as low-stakes: the free tier, the trial, the read-only seat, the login that "doesn't have anything sensitive behind it." The assumption to retire is that low perceived value means low risk, because the same login often holds a saved payment method, a session that pivots elsewhere, or a foothold into the rest of the account. Roku's gap was findable in that exercise before either wave arrived.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →