Roku Mandates 2FA for Customers After Credential-Stuffing Compromise

Roku experienced two credential-stuffing incidents that affected approximately 591,000 accounts; attackers used compromised logins to make purchases on about 400 accounts. Roku has reset passwords for affected users, mandated two-factor authentication for all accounts, reimbursed victims for unauthorized charges, and reported that full credit card numbers and highly sensitive personal data were not exposed.