Roku says 576,000 user accounts hacked after second security incident

Roku confirmed a credential-stuffing campaign that led to unauthorized access to approximately 576,000 user accounts and fraudulent purchases on under 400 accounts; the company refunded affected customers, stated that sensitive/full credit card data were not accessed, and rolled out two-factor authentication to mitigate further account takeovers.