Plex reports limited data breach, urges password resets

Plex, the media streaming company, disclosed on Monday that an unauthorized third party accessed a limited subset of customer account data from one of its databases, and urged users to secure their accounts by resetting passwords and signing out connected devices. The company said the compromised data included usernames, email addresses, securely hashed passwords and unspecified authentication information.

In a support post and emails to customers, Plex said it quickly contained the incident, identified how the intruder gained access and addressed the vulnerability used to breach the system. The company emphasized that it does not store credit card information on its servers and that payment data were not affected. Plex also said it is conducting further reviews of its infrastructure to strengthen defenses against future attacks.

Plex described the stolen passwords as securely hashed, noting this method makes raw passwords unreadable to humans. The company nonetheless recommended that customers immediately reset their passwords by visiting its password reset page and enable the option to sign out connected devices after the change. Plex also encouraged users to enable two factor...