Roku makes 2FA mandatory for all after nearly 600K accounts pwned

Roku disclosed two credential-stuffing incidents earlier this year that resulted in unauthorized access to about 591,000 customer accounts (15,363 in the first incident and ~576,000 in the second). In fewer than 400 cases attackers used stored payment details to purchase subscriptions and hardware; Roku says no full credit card numbers, social security numbers, dates of birth, or other sensitive personal data were exposed, affected customers were reimbursed, mandatory password resets were issued, and two-factor authentication is now required for all accounts.