On March 8, 2024, Roku disclosed that unauthorized actors accessed 15,363 customer accounts using usernames and passwords obtained from unrelated breaches. BleepingComputer reported that some compromised accounts were offered in criminal marketplaces for as little as $0.50 each. This was a credential-stuffing attack—not evidence that Roku’s password database was breached—but account takeovers could still expose subscriptions, settings and, in some cases, usable stored payment methods.
What happened to the Roku accounts?
Criminals first obtained username-and-password combinations from breaches at other companies. They then tested those combinations against Roku accounts. Where customers had reused a password, the reused credentials opened the Roku account.
As an Amazon Associate I earn from qualifying purchases.
- Attackers tested stolen credentials against Roku.
- Successful logins gave them control of some accounts.
- They changed account information, which could lock out the legitimate owner.
- Roku said attackers attempted to buy streaming subscriptions in a limited number of cases.
- Compromised accounts were marketed through criminal account marketplaces and Telegram-linked channels.
BleepingComputer reported listings priced as low as 50 cents per account and described reported purchases involving Roku hardware and streaming subscriptions. That reporting does not establish that every one of the 15,363 accounts was listed, sold or used successfully.
Free tools Windows power users keep installed
One-click scans. No signup required.
Sources: Roku’s breach notice and BleepingComputer.
#1 Best Overall
- HD streaming made simple: With America’s number 1 TV streaming platform,* exploring popular apps—plus tons of free movies, shows, and live TV—is as easy as it is fun. *Based on hours streamed—Hypothesis Group
- Compact without compromises: The sleek design of Roku Streaming Stick won’t block neighboring HDMI ports, and it even powers from your TV alone, plugging into the back and staying out of sight. No wall outlet, no extra cords, no clutter.
- No more juggling remotes: Power up your TV, adjust the volume, and control your Roku device with one remote. Use your voice to quickly search, play entertainment, and more.
- Shows on the go: Take your TV to-go when traveling—without needing to log into someone else’s device.
- TV, simplified: With setup that only takes minutes, a simple-to-navigate Home Screen, and an uncluttered remote control that does all you need—Roku makes it easier to watch the TV you love.
Was Roku itself hacked?
Not according to Roku’s disclosure. Roku said the usernames and passwords came from third-party sources unrelated to Roku. The evidence therefore supports calling this account takeover caused by credential reuse, rather than a confirmed compromise of Roku’s password database.
That qualification does not mean Roku accounts were safe: unauthorized actors did access accounts, and Roku’s defenses were bypassed or overwhelmed. “Roku was not hacked” is too broad; “Roku has not attributed this incident to a breach of its password database” is more accurate.
Credential stuffing explained
Credential stuffing is the automated testing of stolen username-and-password pairs against other websites, relying on password reuse.
Rank #2
- 4K streaming made simple:With America’s number 1 TV streaming platform,* exploring popular apps—plus tons of free movies, shows, and live TV—is as easy as it is fun. *Based on hours streamed—Hypothesis Group
- 4K picture quality: With Roku Streaming Stick Plus, watch your favorites with brilliant 4K picture and vivid HDR color.
- Compact without compromises: Our sleek design won’t block neighboring HDMI ports, and it even powers from your TV alone, plugging into the back and staying out of sight. No wall outlet, no extra cords, no clutter.
- No more juggling remotes: Power up your TV, adjust the volume, and control your Roku device with one remote. Use your voice to quickly search, play entertainment, and more.
- Shows on the go: Take your TV to-go when traveling—without needing to log into someone else’s device.
| Attack type | How it works |
|---|---|
| Credential stuffing | Uses real credentials stolen from another service. |
| Brute force | Guesses passwords repeatedly rather than relying on a known stolen pair. |
| Phishing | Tricks a person into submitting credentials to an attacker. |
| Malware | Steals credentials from an infected device or browser. |
| Database breach | Obtains credentials directly from the target company’s systems. |
BleepingComputer reported the use of credential-stuffing tools including OpenBullet 2 and SilverBullet. Those tools and configurations can enable abuse; this article does not provide operational instructions.
What attackers could do with a compromised account
- Change the account email address or password.
- Change shipping information and review linked devices.
- View or alter active subscriptions.
- Attempt to purchase streaming subscriptions.
- Potentially use stored payment methods for eligible purchases, according to BleepingComputer’s reporting.
- Try the same email-and-password combination against the victim’s other services.
Roku’s notice confirms account-information changes and attempted subscription purchases. The hardware-purchase and stored-card details come from BleepingComputer and should not be read as proof that every affected account experienced those actions.
What information was exposed?
| Potentially involved | Roku said was not exposed |
|---|---|
| Roku login and account access | Social Security numbers |
| Account settings, subscriptions and purchase activity | Full payment-account numbers |
| Possibly usable stored payment methods after takeover | Dates of birth and similar sensitive personal information |
Roku did not say that attackers stole complete credit-card numbers. A stored payment method may nevertheless have been usable for an authorized-in-account purchase, so customers should check order history and card statements.
Rank #3
- Stunning 4K and Dolby Vision streaming made simple: With America’s number 1 TV streaming platform,* exploring popular apps—plus tons of free movies, shows, and live TV—is as easy as it is fun. *Based on hours streamed—Hypothesis Group
- Breathtaking picture quality: Stunningly sharp 4K picture brings out rich detail in your entertainment with four times the resolution of HD. Watch as colors pop off your screen and enjoy lifelike clarity with Dolby Vision and HDR10+.
- Seamless streaming for any room: With Roku Streaming Stick 4K, watch your favorite entertainment on any TV in the house, even in rooms farther from your router thanks to the long-range Wi-Fi receiver.
- Shows on the go: Take your TV to-go when traveling—without needing to log into someone else’s device.
- Compact without compromises: Our sleek design won’t block neighboring HDMI ports, so you can switch from streaming to gaming with ease. Plus, it’s designed to stay hidden behind your TV, keeping wires neatly out of sight
What affected Roku users should do
Reset the Roku account
- Go directly to my.roku.com.
- Select “Forgot password?” and use the reset email.
- Create a new, unique password that has never been used elsewhere.
- Review linked devices, subscriptions, account details and recent activity.
- Check for unfamiliar orders or charges.
- Contact Roku if anything is wrong.
Roku’s notice lists 1-816-272-8106 and [email protected]. Navigate to Roku independently rather than trusting contact details in an unsolicited message.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Change reused passwords everywhere
If the Roku password was reused, change it on every service that used the same password or email-password combination. Prioritize email, banking and payment accounts, shopping services, Apple, Google, Microsoft, Amazon, Netflix and other entertainment accounts. Changing only the Roku password leaves the other accounts exposed.
Handle unauthorized purchases
- Contact Roku through an independently verified official support route.
- Review Roku order history and your payment-card statements.
- Notify the card issuer about any unauthorized transaction.
- Save order emails, reset notices and screenshots.
Roku said it investigated charges, canceled unauthorized subscriptions where appropriate and refunded unauthorized charges. Do not assume every transaction will be reversed automatically.
Rank #4
- Hides behind your TV: The all-new design plugs right into your TV with a simple setup
- Super-fast startup: Start streaming channels like Disney+, Prime Video, HBO Max, Apple TV+, Netflix, Sling, and Hulu in a snap—just turn on your TV
- Long-range Wi-Fi: Enjoy fast, smooth TV streaming in any room with a strong Wi-Fi connection, now up to 2x faster
- No more juggling remotes: Power up your TV, adjust the volume, and control your Roku Streaming Stick with the Roku remote
- Voice search & control: Quickly search, play entertainment, and control your streaming device with the voice remote
If the attacker changed the email address
The normal reset flow may fail when an attacker replaces the account email. Contact Roku through its official support channel and be prepared to establish account ownership. Support may not be able to restore every account or reverse every transaction.
Watch for follow-up phishing
Publicity about a breach gives scammers a convincing pretext. Treat unexpected “Roku security,” refund or password-reset messages as suspicious.
- Do not click unsolicited reset links.
- Never share a password or one-time code.
- Do not call numbers embedded in suspicious messages.
- Do not install remote-access software at someone else’s request.
- Open a browser and type Roku’s address yourself.
Do you need a credit freeze?
Not automatically. Roku said the incident did not expose Social Security numbers, full payment-account numbers, dates of birth or similar identity data normally associated with credit fraud. A freeze does not secure a Roku account or stop streaming purchases.
Best Value
- Upgrade your TV, instantly – Fire TV Stick HD is our fastest HD streaming stick ever, with a streamlined navigation that jumps straight to your movies, shows, and live TV. Take your entertainment on the go with the new ultra-portable profile. And watch it all come to life with crisp Full HD and Wi-Fi 6 support.
- The newest Fire TV experience (2026) – Our biggest update to Fire TV has a new, modern design that gets you to your entertainment fast. Browse dedicated content categories, pin more of your favorite apps, and get personalized recommendations from Alexa+. Spend less time scrolling, and more time watching.
- All your apps in one place – Prime Video, Netflix, YouTube, Disney+, Apple TV, HBO Max, Hulu, Peacock, Paramount+, and thousands more. It’s easy to find what to watch from hundreds of thousands of movies and TV episodes, including free, ad-supported content. Subscription fees may apply.
- Our most portable stick – Thin and light, without extra clutter. Connects directly to your TV's HDMI port without blocking other ports.
- Easier than ever to set up – Now with Direct Power, it's powered by your TV with the included USB-C cable and eliminates the need for a wall adapter.
If you see suspicious credit inquiries, new accounts or broader identity-theft activity, consider a fraud alert or credit freeze. U.S. readers can review reports at AnnualCreditReport.com and find reporting guidance at IdentityTheft.gov.
Two-factor authentication: a historical qualification
BleepingComputer reported that Roku did not support two-factor authentication at the time of the 2024 incident. Account-security features can change, so check Roku’s current options rather than relying on that historical limitation. Whatever features are available, unique passwords remain essential.
A separate Roku disclosure involved about 576,000 more accounts
In April 2024, Roku disclosed a separate incident involving approximately 576,000 additional accounts. The Desk reported that fewer than 400 of those accounts showed evidence of unauthorized purchases. This later disclosure should not be added to the original 15,363-account figure or treated as the same event.
Source: The Desk.
Preventing the next credential-stuffing attack
- Use a different password for every account.
- Let a password manager or browser generate long random passwords.
- Store recovery email and phone details securely.
- Enable multi-factor authentication wherever the service supports it.
- Review payment statements and account alerts regularly.
Password managers such as Bitwarden, 1Password and Proton Pass can help generate and store unique credentials. Their brands are less important than the behavior: never reuse the Roku password elsewhere. Hardware security keys from Yubico can strengthen services that support them, but do not assume a security key works with Roku unless Roku’s current documentation says so.
The Bottom Line
The March 2024 incident involved 15,363 Roku account takeovers through reused credentials from third-party breaches. Roku said full payment-account numbers and major identity fields were not exposed, but attackers could change accounts and attempt purchases. Reset your Roku password, change every reused password, inspect subscriptions and card statements, and treat unexpected Roku messages as potential phishing.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
