Roku

Disclosed Mar 8, 2024576,000 affectedConfirmed

Credential stuffing compromises about 15,000 Roku accounts

Roku notified users in March 2024 that attackers used username and password pairs stolen from other services to access Roku accounts between late December 2023 and February 2024. TechCrunch reported about 15,000 accounts were affected in this first incident.

What is known

People affected	576,000 (as reported by the organization)
Disclosed	Mar 8, 2024
Discovered	Dec 28, 2023
Happened	Dec 28, 2023
Attack	Credential stuffing
Data exposed	EmailsCredentials and tokensPayment cards
Sector	Media · US
Status	Confirmed

Sources

Official noticeoag.ca.gov

California Attorney General breach notice: Roku

Regulatoroag.ca.gov

California AG breach notice: Roku, Inc.

Newstechcrunch.com

Roku says 576,000 user accounts hacked after second security incident

Notices filed

Residents of CAMar 8, 2024

California AGCount not stated

TotalMar 8, 2024

ResearchCount not stated

TotalApr 12, 2024

Research576,000 people

History of this record

discovered2026-09-25

empty to 2023-12-28by seedSource

summary2026-09-25

Roku said about 576,000 user accounts were accessed through credential stuffing, discovered while it was notifying victims of an earlier incident. Fewer than 400 accounts saw fraudulent purchases, which Roku refunded, and it then rolled out to Roku notified users in March 2024 that attackers used username and password pairs stolen from other services to access Roku accounts between late December 2023 and February 2024. TechCrunch reported about 15,000 accounts were affected in thby seedSource

title2026-09-25

Second credential stuffing attack hits 576,000 Roku accounts to Credential stuffing compromises about 15,000 Roku accountsby seedSource

sector2026-09-25

tech to mediaby seedSource

attack2026-09-25

unknown to credential-stuffingby seedSource

data_types2026-09-25

[] to ["emails","credentials","payment-card"]by seedSource

records_basis2026-09-25

empty to organizationby seedSource

records2026-09-25

empty to 576000by seedSource

summary2026-09-25

empty to Roku said about 576,000 user accounts were accessed through credential stuffing, discovered while it was notifying victims of an earlier incident. Fewer than 400 accounts saw fraudulent purchases, which Roku refunded, and it then rolled outby seedSource

title2026-09-25

empty to Second credential stuffing attack hits 576,000 Roku accountsby seedSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about Roku