Plex reports unauthorized access to user data, urges password reset

Plex warned customers on September 8 that an unauthorized party accessed a limited subset of its user database, exposing email addresses, usernames, authentication tokens and securely hashed passwords, and urged all users to reset their passwords immediately. The media streaming and personal media server company said the intrusion was quickly contained and that no credit card or other payment information was exposed because such data is not stored on Plex servers.

In a forum post, Plex said an unauthorized third party gained access to one of its databases and that it has closed the attack vector used. The company is requiring customers to reset their passwords via its password-reset page and recommends choosing the option to sign out of connected devices to block any ongoing access. Plex also urged users to enable two-factor authentication and warned they will never request passwords or payment details by email, advising vigilance against phishing attempts that could follow the breach.

Plex emphasized the leaked passwords were hashed according to industry best practices, meaning they are not readable in their raw form. The company did not disclose which hashing algorithm was...