Roku Data Breach: What Was Exposed and What to Do

Roku said the hackers used passwords stolen elsewhere, not Roku’s own systems.

By Siddharth ShankarUpdated October 22, 2026

The Roku breaches are a clear example of how a password stolen from one site can open another. The streaming company said its own systems were not where the logins came from.

What happened

According to an Associated Press report carried by WJLA, Roku said in March 2024 that unauthorised actors had accessed about 15,000 accounts using login credentials. On April 12, 2024 it said about 576,000 additional accounts were affected.

How the accounts were accessed

Roku said the credentials were taken from another source and used in credential stuffing, where attackers try stolen email and password pairs on other services. It stated there was no indication that Roku was the source of the credentials used in the attacks. In plain terms, people who reused a password across sites were the ones at risk. Read credential stuffing explained.

What the hackers did

In fewer than 400 cases, hackers used stored payment methods to buy streaming subscriptions and hardware, according to the report. Roku said they did not get full credit card numbers or other payment details.

What Roku changed

• Affected accounts had their passwords reset, and affected customers were notified directly.
• Charges made by hackers were refunded or reversed.
• Two-factor authentication became mandatory for all accounts, including unaffected ones. Users receive a verification link by email when they sign in. Roku acknowledged that this adds an extra step.

What to do if you have a Roku account

1. Change your password to one you do not use anywhere else.
2. Review linked subscriptions and devices, which Roku recommended.
3. Look at your payment methods and remove ones you do not need stored.
4. Change the password on any other account where you used the same one.
5. Watch for suspicious activity, and check your bank statements.

What this shows

Streaming and shopping accounts hold stored cards, which makes them useful to criminals. Reusing one password is the weak link, and a password manager removes that problem. Check whether yours has leaked with our guide to checking a leaked password.

Why two-factor authentication matters here

A stolen password alone was enough in these attacks. A second step, such as an emailed link or a code, means a criminal also needs access to your email or phone. That is why Roku made it mandatory, and why you should turn it on for any account that offers it, especially accounts with a saved card.

Signs of an account takeover

Unknown devices, purchases you did not make, or a password that stops working are warning signs. See account takeover warning signs and how to log out of all devices.