Roku account credential stuffing in two waves
Roku disclosed on March 8, 2024 that 15,363 accounts had been accessed with credentials stolen from other sites, and on April 12 that about 576,000 more were hit in a second wave found while investigating the first. Attackers used some accounts to buy streaming subscriptions and hardware with stored payment methods. Roku reset passwords and turned on two-factor authentication for all accounts.
- Victim
- Roku
- Industry
- Media and streaming
- Country
- United States
- Intrusion began
- Dec 2023
- First disclosed
- Mar 8, 2024
- Actor
- Financially motivated
- Initial access
- Credential stuffing
- Identity control that failed
- Authentication
- MFA
- Not enforced on the abused account
- Abused identity
- Human account
- Records affected
- 591,363 (Accounts: 15,363 in the first incident (March 2024) plus about 576,000 in the second (April 2024), per Roku. Fewer than 400 had unauthorized purchases.)
- Disclosed cost
- Not disclosed
The identity lesson
Roku's own fix, mandatory 2FA for every account, is the control that would have prevented both waves.
Go deeper on SWI
- Technique: Credential stuffing
Sources
- An important update regarding Roku accounts, Roku, Mar 8, 2024
- An update on our security incident, Roku, Apr 12, 2024
- Roku disclosed a new security breach impacting 576,000 accounts, Security Affairs, Apr 12, 2024
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Chick-fil-A One loyalty accounts taken over by credential stuffing 2026 · Credential stuffing
- FortiBleed campaign harvests credentials through FortiGate devices 2026 · Credential stuffing
- 23andMe credential stuffing and DNA Relatives data scraping 2023 · Credential stuffing
- Chick-fil-A One account credential stuffing 2023 · Credential stuffing
Cite this record
SWI Community Team. (2026). Roku account credential stuffing in two waves. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2024-roku-credential-stuffing/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.