Over 15,000 hacked Roku accounts sold for 50¢ each to buy hardware

Roku disclosed a credential-stuffing breach affecting 15,363 customer accounts where attackers changed credentials, used stored payment cards to make fraudulent purchases, and sold hijacked accounts on marketplaces (as low as $0.50 each). The campaign used automated cracking tools (OpenBullet2/SilverBullet) with proxy rotation to bypass protections; Roku forced password resets and refunded victims but lacks two-factor authentication, increasing account takeover risk.