The Roku breach headline circulating in 2026 refers to Roku’s April 12, 2024 disclosure—not a newly confirmed mass breach. Roku reported two credential-stuffing incidents: about 15,000 accounts in the first and approximately 576,000 additional accounts in the second. In fewer than 400 cases, attackers used stored payment methods for subscriptions or Roku hardware. Roku said it found no indication that its systems supplied the stolen credentials or that full credit-card numbers were accessed.
If Roku contacted you, reset your password and complete sign-in verification. Even without a notification, review your account, remove password reuse, check charges and devices, and treat unexpected “Roku security” messages as possible phishing.
Is this a new Roku breach?
No new mass consumer breach is established by the official Roku sources reviewed through August 18, 2026. The headline’s “another” refers to the second of two incidents Roku disclosed on April 12, 2024. Roku’s newsroom and 2026 press-release archive do not identify a newer incident of comparable scope.
Check Roku’s official newsroom for later announcements, but do not assume a resurfaced article describes a 2026 event.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →#1 Best Overall
- HD streaming made simple: With America’s number 1 TV streaming platform,* exploring popular apps—plus tons of free movies, shows, and live TV—is as easy as it is fun. *Based on hours streamed—Hypothesis Group
- Compact without compromises: The sleek design of Roku Streaming Stick won’t block neighboring HDMI ports, and it even powers from your TV alone, plugging into the back and staying out of sight. No wall outlet, no extra cords, no clutter.
- No more juggling remotes: Power up your TV, adjust the volume, and control your Roku device with one remote. Use your voice to quickly search, play entertainment, and more.
- Shows on the go: Take your TV to-go when traveling—without needing to log into someone else’s device.
- TV, simplified: With setup that only takes minutes, a simple-to-navigate Home Screen, and an uncluttered remote control that does all you need—Roku makes it easier to watch the TV you love.
What Roku disclosed
| Incident detail | Roku’s reported information |
|---|---|
| First incident | About 15,000 accounts were accessed. |
| Second incident | Approximately 576,000 additional accounts were affected. |
| Attack method | Credential stuffing: automated attempts using usernames and passwords obtained from another source. |
| Unauthorized purchases | Fewer than 400 accounts had subscriptions or Roku hardware purchased with stored payment methods. |
| Payment information | Roku said full credit-card numbers and other full payment information were not accessed. |
| Roku’s response | It reset affected passwords, notified affected customers, and reversed or refunded identified unauthorized purchases where appropriate. |
Adding the two approximate figures produces roughly 591,000 reported account incidents, but that is not a confirmed unique-person total because Roku’s public statement does not establish whether any accounts appeared in both incidents.
Credential stuffing is not the same as a Roku database theft
In credential stuffing, criminals test login combinations leaked from an unrelated website against other services. Reusing a password makes the attack effective: a password exposed in an old shopping, gaming or social-media breach may also unlock a Roku account.
Roku said it found no indication that Roku was the source of the credentials or that Roku’s systems had been compromised in these incidents. That is Roku’s characterization of the event; it does not prove that every account was untouched or that reused passwords are safe elsewhere.
Rank #2
- Ultra-speedy streaming: Roku Ultra is 30% faster than any other Roku player, delivering a lightning-fast interface and apps that launch in a snap.
- Cinematic streaming: This TV streaming device brings the movie theater to your living room with spectacular 4K, HDR10+, and Dolby Vision picture alongside immersive Dolby Atmos audio.
- The ultimate Roku remote: The rechargeable Roku Voice Remote Pro offers backlit buttons, hands-free voice controls, and a lost remote finder.
- No more fumbling in the dark: See what you’re pressing with backlit buttons.
- Say goodbye to batteries: Keep your remote powered for months on a single charge.
What information could be at risk?
Unauthorized actors could access affected Roku accounts. Roku reported limited payment misuse, but said full card numbers and other complete payment details were not accessed. The disclosure does not establish exposure of Social Security numbers, identity documents or Roku’s entire customer database.
Roku’s privacy policy describes account data categories such as an email address, password, payment methods, preferences, settings, installed apps and device information. Those categories describe what an account may contain; they do not prove that every field was viewed in the 2024 incidents.
How to tell whether your account was affected
Look for a genuine Roku notification
Roku said it notified affected customers directly and reset their passwords. A required reset or an account-security message may therefore indicate inclusion in the investigated incidents. Branding alone is not proof: verify by opening Roku manually rather than clicking an unsolicited link.
Rank #3
- 4K streaming made simple:With America’s number 1 TV streaming platform,* exploring popular apps—plus tons of free movies, shows, and live TV—is as easy as it is fun. *Based on hours streamed—Hypothesis Group
- 4K picture quality: With Roku Streaming Stick Plus, watch your favorites with brilliant 4K picture and vivid HDR color.
- Compact without compromises: Our sleek design won’t block neighboring HDMI ports, and it even powers from your TV alone, plugging into the back and staying out of sight. No wall outlet, no extra cords, no clutter.
- No more juggling remotes: Power up your TV, adjust the volume, and control your Roku device with one remote. Use your voice to quickly search, play entertainment, and more.
- Shows on the go: Take your TV to-go when traveling—without needing to log into someone else’s device.
Check sign-in and account changes
- You are forced to reset a password or complete an unfamiliar security step.
- Your password no longer works, or recovery details have changed.
- Unfamiliar devices, subscriptions, billing details or account settings appear.
- You receive password-reset or verification messages you did not request.
An unexpected message can also be a phishing attempt, so confirm activity from the account itself.
Review purchases and devices
Check channel subscriptions, Roku hardware orders and other charges. The absence of a suspicious charge is reassuring but does not prove that no one accessed the account; an attacker could change credentials or add a device without buying anything.
What to do now
- Open Roku independently. Type the known Roku account or support address into a fresh browser tab. Do not enter credentials through a link in an unexpected email or text.
- Complete two-step verification. Roku’s current process sends a six-digit code to the account email. If a linked streaming device is available, Roku may accept the last five characters of its device ID as an alternative. Details are in Roku’s two-step-verification guide.
- Change the Roku password. Go to Account information, enter and confirm a new password, then select Save changes. Use a password that has never been used on another service; Roku documents the path at this support page.
- Change any reused password elsewhere. Start with the email account linked to Roku, then financial, shopping, social-media and mobile-carrier accounts. A Roku reset cannot protect another service that still accepts the exposed password.
- Review activity and stored payment methods. Look for unfamiliar subscriptions, hardware orders, billing changes and devices. Save screenshots, receipts and support case numbers.
- Set a Roku purchase PIN. Roku says a PIN can control purchases and parental controls. It helps limit purchases made through the device but does not replace a unique password or two-step verification. See Roku’s security guidance.
- Dispute unauthorized charges. Ask Roku support about cancellation, reversal or a refund. If the charge remains unresolved or broader payment abuse is suspected, contact the card issuer or bank and consider removing or replacing the stored payment method.
If you cannot receive the verification code
The email account is the recovery bottleneck. Secure that mailbox first if it may be compromised, including changing its password and reviewing forwarding rules. If you cannot access the verification email or use a linked-device ID, Roku says to contact customer support and confirm account information before changing the account email.
Rank #4
- Stunning 4K and Dolby Vision streaming made simple: With America’s number 1 TV streaming platform,* exploring popular apps—plus tons of free movies, shows, and live TV—is as easy as it is fun. *Based on hours streamed—Hypothesis Group
- Breathtaking picture quality: Stunningly sharp 4K picture brings out rich detail in your entertainment with four times the resolution of HD. Watch as colors pop off your screen and enjoy lifelike clarity with Dolby Vision and HDR10+.
- Seamless streaming for any room: With Roku Streaming Stick 4K, watch your favorite entertainment on any TV in the house, even in rooms farther from your router thanks to the long-range Wi-Fi receiver.
- Shows on the go: Take your TV to-go when traveling—without needing to log into someone else’s device.
- Compact without compromises: Our sleek design won’t block neighboring HDMI ports, so you can switch from streaming to gaming with ease. Plus, it’s designed to stay hidden behind your TV, keeping wires neatly out of sight
If you have forgotten which email is linked, on a Roku device go to Home → Settings → System → About. Roku says the same information may be available in its mobile app. The account-email instructions are in the password and email support article.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to avoid Roku follow-on scams
Public breach stories often trigger fake “account locked” or “payment update” messages. Roku warns about requests for passwords, payment details or clicks on unusual links, and says it never charges to create an account, activate a device or provide customer support.
- Inspect the sender address and destination before doing anything.
- Never type a password after following an unsolicited message.
- Open Roku in a new tab and check the account directly.
- Use official support pages if a message is unclear.
- Do not pay a caller or website claiming to “activate” Roku or remove a breach.
Do you need to factory-reset a Roku TV?
Not for this credential-stuffing incident. Account recovery, a unique password, two-step verification, payment review and securing reused credentials address the reported risk. A factory reset can erase settings and create setup work without changing a password that is reused elsewhere.
Best Value
- Streaming made easy: Roku Express lets you stream free, live and premium TV over the Internet—right to your TV. It’s perfect for new users, secondary TVs and easy gifting—but powerful enough for seasoned pros
- Quick and easy setup: Just plug it into your TV with the included High Speed HDMI Cable and connect to the internet to get started
- Tons of power, tons of fun: Compact and power-packed, you’ll stream your favorites with ease; from movies and series on Apple TV, Prime Video, Netflix, The Roku Channel, HBO, Showtime and Google Play to cable alternatives like Hulu with Live TV and PlayStation Vue, enjoy the most talked about TV across free and paid channels
- Low cost, no extra fees: For under $30, Roku Express streaming device includes a High Speed HDMI Cable—and there’s no monthly equipment fee; with access to free TV on hundreds of channels, there’s plenty to stream without spending extra
- Simple remote: Incredibly easy to use, this remote features shortcut buttons to popular streaming channels
Resetting may make sense when a device is lost, sold or transferred, but follow Roku’s device-specific guidance at the lost-device support page. Roku distinguishes streaming devices from Roku Smart Home devices; deleting a Smart Home device from an account can interfere with protections against another person setting it up under a different account.
What this means for payment and identity-theft risk
There are two different risks. Roku said full card numbers were not accessed, while fewer than 400 accounts experienced unauthorized purchases using stored payment methods. Therefore, owning a Roku account alone does not establish that your card number or identity documents were exposed.
The broader practical risk is password reuse. A password manager can help generate unique credentials, but it cannot determine whether Roku identified your account, reverse a charge or recover a mailbox that an attacker controls. Consider a credit freeze or fraud alert only if you see signs of broader identity fraud, not simply because you use Roku.
Quick Recap
Where to get authoritative help
- Roku’s April 12, 2024 incident disclosure
- Sign-in with two-step verification
- Change your Roku password or email
- Keep your Roku account secure
- Precautions for a lost or stolen device
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →
