Getty Images
On Wednesday, media streaming platform Plex said it was hacked by intruders who managed to gain access to a proprietary database and make off with password data, usernames and emails belonging to at least half of its users. 30 million customers.
“Yesterday we discovered suspicious activity in one of our databases,” company officials wrote in an email sent to customers. “We immediately launched an investigation and it appears that a third party was able to access a limited subset of data that includes emails, usernames and encrypted passwords.”
The email said the passwords were “hashed and secured according to best practices,” meaning the passwords were cryptographically encoded in a way that requires attackers to devote additional resources to cracking the hashes and re- them in their plain text state. A Plex spokesperson said the passwords were split using bcrypt, one of the strongest algorithms for protecting passwords. bcrypt automatically applies what is known as cryptographic salt and pepper to make cracking more difficult.
However, the company requires all customers to reset their passwords. Step by step instructions are here. For good measure, the company advises to sign out of all connected devices after the password change and sign in again.
announcement
The email also said that no payment card data was stored in the database that was accessed and therefore is not affected by the breach.
Several people reported having trouble logging into their accounts Wednesday morning. Security researcher Troy Hunt posted a screenshot of the errors he received when trying to log into his account.
Two Ars employees said they too initially had trouble accessing their accounts, but eventually succeeded. A third person connected to Ars reported that he had reset his password and received an email from Plex immediately after asking him to reset his password again. The email sent him in a loop when he couldn’t log in with the new password.
Plex is a leading provider of media streaming services that allow users to stream movies and audio, play games, and access their own content hosted on home or local media servers. A Plex spokesperson said the company has more than 30 million registered users, and most of them were affected by the breach.
Wednesday’s notification said company officials have already discovered the means the intruders used to access the database and have fixed it. Engineers continue to conduct additional reviews to prevent similar breaches from occurring again.