Key Takeaways

• Roku experienced a breach impacting over 15,000 accounts due to credential stuffing attacks.
• You should check other accounts that use the same login info if you received a Roku security notice.
• Locate and secure any accounts linked to the compromised credentials to protect your data.

Have you recently received a password reset email from Roku? If so, you’d better check your other online accounts too.

In March 2024, streaming and smart TV giant Roku revealed that 15,000+ accounts were breached using a credential stuffing attack—which means any account you used the same password for is also vulnerable.

What Happened to Roku? How Was Roku Breached?

Roku’s official data breach notice [PDF] revealed suspicious activity on more than 15,000 Roku accounts.

However, despite Roku bearing the brunt of the issue, it wasn’t fully at fault. It appears the accounts were all breached using credential stuffing:

Through our investigation, we determined that unauthorized actors had likely obtained certain usernames and passwords of consumers from third-party sources (e.g., through data breaches of third-party services that are not related to Roku). It appears likely that the same username/password combinations had been used as login information for such third-party services as well as certain individual Roku accounts.

Credential stuffing, i.e., an attack that reuses the same username and password information across multiple services, is a massive user error and a huge problem in the age of enormous data breaches.

In this case, the attackers used the information to make purchases using banking details saved on Roku. But even then, Roku didn’t provide Social Security numbers, full payment account information (all purchases were limited to Roku), or other identifying information.

Received a Roku Password Reset Email? You Should Review Your Other Accounts

Now, credential stuffing is dangerous because people use the same username and password combo across multiple services. So if you received a password reset email from Roku following the breach, it stands to reason you should have a look at your other accounts.

Anywhere you use the same username and password combination could be at risk, even if you don’t use weak commonly used passwords. (You should never use those passwords!)

How to Check If Your Username and Password Are Breached

There are a couple of ways to figure out if your email and password combination has been exposed in a breach.

The first involves a trip to HaveIBeenPwned, Troy Hunt’s incredibly useful and free data breach checking site. Just enter your email address and hit pwned?, and it’ll reveal all of the data breaches your email address is found in.

That’s a good starting point, but it doesn’t specify usernames, account names, passwords, and so on (for good reason!). To find out where you used the username and password combination, you’re going to have to dig deeper, manually. We’ve covered how to find accounts associated with an email address in-depth, but here’s a quick overview of the methods you can use:

1. Find Accounts Linked to Email for Free: Email accounts like Gmail and Outlook track linked accounts, and you can find the information there.
2. Find Social Sign-Ins With Facebook and Twitter: Browse all the apps and websites you’ve logged into using your social media accounts.
3. Search Your Inbox for Account Verification Messages: Scroll through your account and find those sign-up messages.
4. Use Third-Party Account Deletion Tools: They can track down and erase your accounts.
5. Find All Online Accounts With Namechk: This service scans websites for available usernames, and if your regular name is taken, you might have an account there.
6. Check Your Browser’s Saved Accounts: While not the most secure password management method, it works well for many folks.
7. Use a Password Manager: You likely use a strong, unique passwords with a password manager, but you might have had an off-day where you left some duplicates or weak passwords.

When you track down your old accounts, change each one to have a strong and unique password. Doing so will ensure your accounts are secure against not just credential stuffing attacks but other types of account breaches, password fraud, and more.

So take a minute to search your inbox for a Roku password reset email, and if it’s there, take action to stay safe!