Plex Data Breach Notification
Sep 10, 2025 | 5:59 am
#1
Original Poster
Join Date: Jan 2015
Posts: 3,692
Plex Data Breach Notification
While I don't use them personally, I suspect a significant number of FTers do so...
https://www.bleepingcomputer.com/new...w-data-breach/
TLDR: Looks like Plex has been hacked. Plex is recommending resetting your password (out of an abundance of caution).
https://www.bleepingcomputer.com/new...w-data-breach/
TLDR: Looks like Plex has been hacked. Plex is recommending resetting your password (out of an abundance of caution).
Sep 10, 2025 | 10:37 am
#3
FlyerTalk Evangelist
Join Date: Nov 2002
Location: ORD
Posts: 14,735
I just changed my password and didn't need to reclaim the server or anything. When you change the password just uncheck the box (or was it check the box?)...either way, tell it not to sign out all devices.
Sep 10, 2025 | 7:52 pm
#4
Join Date: Dec 2009
Location: RDU
Programs: DL DM+(segs)/MM, UA Ag, Hilton DM, Marriott Ti (life Pt), TSA Opt-out Platinum
Posts: 3,365
I think this is the second time Plex has been "hacked" in the 10 years or so I've been using it. I use a unique random username/password for every login so I'm not so worried about this one. If it were my bank or broker I'd be worried. 
. Like any hack, I'd be interested to learn more about what happened, but sadly much of that never sees the light of day.
I think any company that is larger than x amount of users or y amount of revenue should: A) be subject to some level of cybersecurity disclosures and/or audits, and B) should have to disclose details of a compromise (after it's been patched), and perhaps: C) be financially penalized for loss of user information in their care (whether it's used nefariously or not).
. Like any hack, I'd be interested to learn more about what happened, but sadly much of that never sees the light of day.I think any company that is larger than x amount of users or y amount of revenue should: A) be subject to some level of cybersecurity disclosures and/or audits, and B) should have to disclose details of a compromise (after it's been patched), and perhaps: C) be financially penalized for loss of user information in their care (whether it's used nefariously or not).
Sep 10, 2025 | 9:12 pm
#5
Original Poster
Join Date: Jan 2015
Posts: 3,692
I think this is the second time Plex has been "hacked" in the 10 years or so I've been using it. I use a unique random username/password for every login so I'm not so worried about this one. If it were my bank or broker I'd be worried. . Like any hack, I'd be interested to learn more about what happened, but sadly much of that never sees the light of day.
I think any company that is larger than x amount of users or y amount of revenue should: A) be subject to some level of cybersecurity disclosures and/or audits, and B) should have to disclose details of a compromise (after it's been patched), and perhaps: C) be financially penalized for loss of user information in their care (whether it's used nefariously or not).
. Like any hack, I'd be interested to learn more about what happened, but sadly much of that never sees the light of day.I think any company that is larger than x amount of users or y amount of revenue should: A) be subject to some level of cybersecurity disclosures and/or audits, and B) should have to disclose details of a compromise (after it's been patched), and perhaps: C) be financially penalized for loss of user information in their care (whether it's used nefariously or not).
As for what companies should do, they should have a team that reviews their existing security processes at least semi-annually and update (or set up a project to update) their security processes... eg, the annual process realises that this new module for some reason isn't using encryption, should be updated or if not possible, figure a way to limit the damage it could cause).
