Plex.tv streaming media platform is warning its customers about a security breach that may have led to a data leak and compromised account information, including usernames, email addresses, and passwords. While there is no indication that encrypted passwords were exposed, Plex is advising all users to change their passwords immediately.
Plex is one of the largest media server applications, used by around 20 million people to stream video, audio, and photos they upload themselves, in addition to the growing variety of content the service provides to paid subscribers.
The email states,
"Yesterday, we discovered suspicious activity in one of our databases. We immediately began an investigation and it appears that a third party was able to access a limited subset of data including emails, usernames, and encrypted passwords.".
There is no confirmation that other personal account information has been compromised, and there is no mention of private media libraries (which may or may not include pirated content, private nudity, and other sensitive content) being accessed during the breach.
Plex reassures customers that “all passwords they could have accessed were hashed and secured in accordance with best practices.” Financial information also appears to be safe despite the breach, with the email stating “credit card and other payment data is not stored on servers and was not vulnerable in this incident.”
The cause of the breach has been found, and Plex has taken steps to prevent others from taking advantage of the same security flaw. “We have already addressed the method the hacker used to gain access to the system and are conducting additional checks to ensure that the security of all of our systems is further enhanced to prevent future intrusions.”
If you have a Plex account, you should take steps to secure it immediately by following these instructions provided by the company. You should also enable 2-factor authenticationif you haven't already. Plex places the Two-Factor Authentication option on your account page.
Additionally, you should use either a free or paid password manager to easily manage unique, hard-to-guess passwords and 2fa across all your apps, services, and websites. Web browsers like Google Chrome, Microsoft Edge, and Safari have decent built-in options, though dedicated services are also available from Bitwarden, 1Password, and Lastpass. Some password managers will alert you to passwords that have been compromised online and autofill passwords when prompted by apps and websites on your computer and phone.
