Plex urges users to change passwords after data breach

Streaming platform Plex is advising its users to update their passwords after revealing a compromise of one of its user databases. In a statement released on Monday, the company acknowledged a security incident that resulted in the theft of sensitive customer account information, including usernames, email addresses, scrambled passwords, and some authentication data. While Plex assured users that the passwords were scrambled to prevent easy readability, the company has not confirmed whether these passwords could potentially be decrypted or if the stolen authentication data might allow unauthorized access to accounts. To enhance security, Plex is recommending that customers utilize the password reset feature on their website. Users are also encouraged to log out of all connected devices as an additional precaution. Typically, companies facing data breaches involving user information—regardless of the encryption status—opt to force password resets to mitigate malicious access risks. However, Plex's decision not to enforce such a reset has raised questions among users. The company has provided limited information regarding the breach but mentioned that it has taken steps to rectify the method used by the third party to infiltrate its system. Details such as the extent of the breach, the number of affected users, and the timeline of the incident remain unclear. Plex, which boasts approximately 25 million users globally, has not disclosed when the breach occurred, how long the hackers had access, or when the company identified the security issue. Additionally, no specifics have been shared about the nature of the cyberattack or whether any ransom demands have been made. A spokesperson for Plex, Jessica Finn, did not respond to inquiries from TechCrunch before the deadline for this report.