Plex Data Breach

[pio]

Quote

Plex users may want to change their passwords as soon as they're able. The digital media player and streaming service said a bad actor had infiltrated its system in a letter sent to users affected by the breach. In it, the company has revealed that it immediately started an investigation after it saw suspicious activity in one of its databases. Based on what it saw, Plex said it does appear that a third-party entity got access to a subset of its data, which includes people's emails, usernames and encrypted passwords. 

.......................

Plex said it has already addressed the method the bad actor used to infiltrate its system, but it didn't elaborate on what method that is or what vulnerability the hacker exploited if any. The company also vowed to do additional reviews to make sure its systems are "further hardened to prevent future incursions." For now, Plex is requiring all users to change their passwords "out of an abundance of caution" even if all the passwords the hacker got access to were hashed. It also assured all users in its letter that it doesn't store credit card numbers and other payment data in its servers, so the bad actor wasn't able to get access to them. 

Plex tells users to reset their passwords after potential data breach | Engadget

WWW.ENGADGET.COM

---

A third-party entity was able to access users' emails, usernames and encrypted passwords..

 

Just grabbed the first link I could find, I actually found out about this due to an email I got at like 1:30am.  Just as a friendly heads up, it was a major pain to update everything.  If you're a plex user, check your email.  There should be a legit email from them explaining everything in halfway decent detail (well, as best they can).  Looks like the letter is also shared on a twitter link in the article too.

Edited August 24, 2022 by pioneerisloud

[UltraMega]

A bad actor...  I didn't know Nicholas Cage was a cyber security threat. 

 

 

Ok bye. 

[pio]

1 hour ago, UltraMega said:

A bad actor...  I didn't know Nicholas Cage was a cyber security threat. 

 

 

Ok bye. 

Oh all of the puns we could make here......Nicholas Cage was more of a National Treasure threat though.    Will Smith, Alec Baldwin, Gene Hackman, ummmm that one buff dude that's always coked up because he doesn't want to die, maybe Denzel.  So many names we could pick on.  

 

[ENTERPRISE]

Yeah I got the email too, will change the password for sure. They say that the passwords stolen were encrypted...so that's something lol.

[pio]

25 minutes ago, ENTERPRISE said:

Yeah I got the email too, will change the password for sure. They say that the passwords stolen were encrypted...so that's something lol.

Honestly I feel like they handled the whole thing pretty well considering.  The issue is already patched, emails sent out to everyone urging to change passwords simply as a precaution, and letting everyone know that no really bad information was actually leaked.  Can't get much better than that I suppose.

[ENTERPRISE]

9 hours ago, pioneerisloud said:

Honestly I feel like they handled the whole thing pretty well considering.  The issue is already patched, emails sent out to everyone urging to change passwords simply as a precaution, and letting everyone know that no really bad information was actually leaked.  Can't get much better than that I suppose.

Oh for sure, they handled it as I would expect from any company, not all companies get it right but as a long term user of Plex, I am glad to see they are on the ball. 

 

I also realized I have 2FA on my account, another reason why you should use 2FA wherever possible.

 

For anyone wondering, EHW has 2FA if you want to set it up

[schuck6566]

Give them credit,been years since I've used my acct, and they still notified me. screenshot of actual letter if anyone wants to see how they let peeps know. The included link to reset was nice because it let me click and then just go to "forgot password" since it's been literally years and different comps between uses. 

Edited August 25, 2022 by schuck6566

[pio]

4 hours ago, schuck6566 said:

Give them credit,been years since I've used my acct, and they still notified me. screenshot of actual letter if anyone wants to see how they let peeps know. The included link to reset was nice because it let me click and then just go to "forgot password" since it's been literally years and different comps between uses. 

Yeah and they also included specific directions on how to do it on the website too, in case people thought the letter itself was sus.