Plex recommends password reset after data breach
Plex urges users to change their passwords and log out of devices following data breach
Plex has suffered a “Security Incident” and has confirmed that this data breach may “involve your Plex account information”. Following the breach, Plex has urged users to change their passwords and has recommended that users enable two-factor authentication.
While Plex claims that “the actual impact of this incident is limited”, they have confirmed that the “information that was accessed included emails, usernames, securely hashed passwords, and authentication data. Yes, Plex, that sounds very “limited”.
This is not the first time that Plex has suffered a data breach. In 2015, a hack exposed over 327,000 accounts. Plex also suffered a similar breach to this month’s new security incident in 2022.
We have recently experienced a security incident that may potentially involve your Plex account information. We believe the actual impact of this incident is limited; however, action is required from you to ensure your account remains secure.
An unauthorized third party accessed a limited subset of customer data from one of our databases. While we quickly contained the incident, information that was accessed included emails, usernames, securely hashed passwords and authentication data.
Any account passwords that may have been accessed were securely hashed, in accordance with best practices, meaning they cannot be read by a third party. Out of an abundance of caution, we recommend you take some additional steps to secure your account (see details below). Rest assured that we do not store credit card data on our servers, so this information was not compromised in this incident.
We’ve already addressed the method that this third party used to gain access to the system, and we’re undergoing additional reviews to ensure that the security of all of our systems is further strengthened to prevent future attacks.
– Plex
Plex users have been told to reset their account passwords immediately. Users have also been told to sign out of all active sessions. Plex has also told users that they will never email users to ask for passwords or credit card information. Furthermore, the company has recommended enabling two-factor authentication.
What you must do
- If you use a password to sign into Plex: We kindly request that you reset your Plex account password immediately by visiting https://plex.tv/reset. When doing so, there’s a checkbox to “Sign out connected devices after password change,” which we recommend you enable. This will sign you out of all your devices (including any Plex Media Server you own) for your security, and you will then need to sign back in with your new password.
- If you use SSO to sign into Plex: We kindly request that you log out of all active sessions by visiting https://plex.tv/security and clicking the button that says ”Sign out of all devices”. This will sign you out of all your devices (including any Plex Media Server you own) for your security, and you will then need to sign back in as normal.
Additional Security Measures You Can Take
We remind you that no one at Plex will ever reach out to you over email to ask for a password or credit card number for payments. For further account protection, we also recommend enabling two-factor authentication on your Plex account if you haven’t already done so.
Lastly, we sincerely apologize for any inconvenience this situation may cause you. We take pride in our security systems, which helped us quickly detect this incident, and we want to assure you that we are working swiftly to prevent potential future incidents from occurring.
For step-by-step instructions on how to reset your password, visit: https://support.plex.tv/articles/account-requires-password-reset
– Plex
While Plex has confirmed that any compromised passwords are hashed (which means they should not be readable), users should change their passwords immediately. Furthermore, if Plex users use the same passwords for other accounts, they should also change those passwords. Ideally, unique passwords should be used for every account/service.
Plex claims that they have “addressed the method that this third party used to gain access to the systems”, and that it is “undergoing additional reviews to ensure that the security of all our systems is further strengthened to prevent future attacks.”
You can join the discussion on Plex’s latest data breach on the OC3D Forums.
