Important Notice of Security Incident
forums.plex.tv
We have recently experienced a security incident that may potentially involve your Plex account information. We believe the actual impact of this incident is limited; however, action is required from you to ensure your account remains secure. What happened An unauthorized third party accessed a limited subset of customer data from one of our databases. While we quickly contained the incident, information that was accessed included emails, usernames, securely hashed passwords and authentication ...

We have recently experienced a security incident that may potentially involve your Plex account information. We believe the actual impact of this incident is limited; however, action is required from you to ensure your account remains secure.

What happened

An unauthorized third party accessed a limited subset of customer data from one of our databases. While we quickly contained the incident, information that was accessed included emails, usernames, securely hashed passwords and authentication data.

Any account passwords that may have been accessed were securely hashed, in accordance with best practices, meaning they cannot be read by a third party. Out of an abundance of caution, we recommend you take some additional steps to secure your account (see details below). Rest assured that we do not store credit card data on our servers, so this information was not compromised in this incident.

What we’re doing

We’ve already addressed the method that this third party used to gain access to the system, and we’re undergoing additional reviews to ensure that the security of all of our systems is further strengthened to prevent future attacks.

What you must do

If you use a password to sign into Plex: We kindly request that you reset your Plex account password immediately by visiting https://plex.tv/reset. When doing so, there’s a checkbox to “Sign out connected devices after password change,” which we recommend you enable. This will sign you out of all your devices (including any Plex Media Server you own) for your security, and you will then need to sign back in with your new password.

If you use SSO to sign into Plex: We kindly request that you log out of all active sessions by visiting https://plex.tv/security and clicking the button that says ”Sign out of all devices”. This will sign you out of all your devices (including any Plex Media Server you own) for your security, and you will then need to sign back in as normal.

Additional Security Measures You Can Take

We remind you that no one at Plex will ever reach out to you over email to ask for a password or credit card number for payments. For further account protection, we also recommend enabling two-factor authentication on your Plex account if you haven’t already done so.

Lastly, we sincerely apologize for any inconvenience this situation may cause you. We take pride in our security systems, which helped us quickly detect this incident, and we want to assure you that we are working swiftly to prevent potential future incidents from occurring.

For step-by-step instructions on how to reset your password, visit:https://support.plex.tv/articles/account-requires-password-reset

  • JasonDJ@lemmy.zipEnglish
    3051·
    6 days ago

    • admitted the issue immediately

    • reassured users as to actual scope of breach, probable risk

    • provided recommended actions for users who think they may be impacted.

    • explained best-practices (enough for a laymen’s audience) and how they limited scope and impact.

    • did not deflect blame

    My god…I’ve got to hand it to plex. This is the perfect incident response letter. Love 'em or hate 'em, this is a good example for other CISOs.

    • Cocodapuf@lemmy.worldEnglish
      9·
      6 days ago

      Yeah, I have to agree. When a breach occurs (and it happens to just about every organization at some point or another) a press release this honest, responsible and immediate is not really the norm. I see this as a show of competence on the security front and integrity for the company as a whole.

      I do wish Plex wasn’t further enshitifying their product more with every release, but that’s a different issue.

  • ayyy@sh.itjust.worksEnglish
    108·
    6 days ago

    I harbor a strong dislike for the profiteers at Plex but their security incident response is textbook correct. Good job security dudes! The rest of your stupid company should listen to you more often.

    • skisnow@lemmy.caEnglish
      211·
      6 days ago

      It shows how low the bar is, that just bare bones complying with GDPR notification requirements so as not to risk a €20M fine, is enough to make people talk about how good a job you did.

    • reptar@lemmy.worldEnglish
      14·
      6 days ago

      As I slide the needle from “strongly dislike” to “not a fan”.

      Good on em

    • BackgrndNoize@lemmy.worldEnglish
      102·
      6 days ago

      Stuff like this can happen to any app, developers are only human, shit happens. A bigger company is a bigger target for hackers, so there is some saftey in an open source app that’s not as popular, but then again a bigger company also has more resources to monitor for security breaches and quickly address them and push out a hot fix, can’t say I know how this works for free open source apps

      • Logical@lemmy.worldEnglish
        3·
        6 days ago

        But if you just run it locally an a media server in your home, and you don’t expose the service to the internet, that doesn’t really matter? Though perhaps more people connect to their Jellyfin instances remotely than I realize.

        • cosmo@lemmy.worldEnglish
          11·
          6 days ago

          Well. If you’re not streaming why have such a service in the first place? If I didn’t stream remotely with Plex (and share with my friends and family) I’d just go back to running Kodi on my htpc like I did ten years ago.

    • Mongostein@lemmy.caEnglish
      843·
      6 days ago

      No doubt. Why do you need an account on their servers to use a server on your own hardware? So dumb.

      • Archer@lemmy.worldEnglish
        161·
        6 days ago

        The second I saw that I immediately looked for alternatives and abandoned plans to have my own Plex server. I knew it would enshittify fast when they can lock you out of your own server

      • rezifon@lemmy.worldEnglish
        11·
        6 days ago

        Every year Jellyfin improves and Plex further enshittifies. You’re fighting against the tide here.

        • thelittleblackbird@lemmy.worldEnglish
          21·
          6 days ago

          ???

          This is not about enshitification. The best user friendly app can be a security nightmare and an utterly crap can be rock solid.

          It is not about that, not even development models or just rock star programmers.

          It is about who has a performing security team and who doesn’t.

            • thelittleblackbird@lemmy.worldEnglish
              11·
              5 days ago

              If they don’t have a team, they don’t regularly look, if they dont look, they don’t report, if they don’t report your analysis maybe biased because you can only check about what you know…

              I hope you can see my point

  • Phoenixz@lemmy.caEnglish
    495·
    6 days ago

    I hate the tone companies always use with this

    Some evil guys did something to us, it happened to us, and there was nothing we could have done to prevent it, but we were so quick to respond and stop it!

    Aka, you fucked up with your security. Could you just once admit that?

    • b34k@lemmy.worldEnglish
      7·
      6 days ago

      I’m no lawyer, but wouldn’t that basically open them up to an instant win for anyone who files lawsuits against them?

      • Phoenixz@lemmy.caEnglish
        1·
        3 days ago

        I’m sure it does, but had they done their security right it likely wouldn’t have happened.

        Yeah, 100% secure doesn’t exist but at the same time it’s always closed source companies like these that turn out to have horrible software security. Can’t say for sure of course, but at this point it’s a safe bet

      • Smoogs@lemmy.worldEnglish
        11·
        6 days ago

        Yes and no. hacking isn’t new. Everyone could get sued technically for security breaches for not taking enough interest in their own security.

        But then it’s ridiculous if you could sue your own grandma cuz you once used her computer to print your resume and because she uses default passwords now someone has all your info you had from anything you left behind.

        Ransom and hacking is pretty common unfortunately in the industry. And it is in part on the user to also take practices to protect themselves if they haven’t enabled 2F yet. And there’s way more you can do where you make email masks now and simply do not fill in with your accurate information like don’t use your real name.and use a VPN. Store stuff on ext drives and less on clouds that don’t use e2e encryption

        I don’t know if it’s perfect but as a user just always have it back in your mind that your information can be obtained(if you ever used a web service to check your info on the dark web, this is pretty much going to be a given) . And it probably has. So maybe at least you can try to control what gets obtained.

        • AA5B@lemmy.worldEnglish
          1·
          6 days ago

          In some ways 2fa is a weak spot even disregarding recovery processes being open to social engineering, now you’re giving a verified identifier uniquely tied to you

          I generate unique email addresses and passwords for every account but can’t realistically do that with phone numbers

          2fa by sms or voice isn’t especially secure anyway since you’re open to sim attacks and social engineering. I have a lot more hope for Passkeys but don’t really trust the practical advice arts of managing them yet

          • Smoogs@lemmy.worldEnglish
            1·
            4 days ago

            …second phone number…

            Anyways… we are digressing here,

            at this point it’s a lot like protecting anything in life: prevention and making yourself less tasty to a psycho.

            If you’ve set it even two step You’re already doing way more than any user they are probably intending this warning to do more to protect themselves who set their password to “password” or phrases haven’t changed it in decades and would even prefer to publicly post their passwords on social willing to give up their entire savings rather than having to do anything further as if technology is too beyond and suddenly so super complex that they have to use different keys on their keyboard other than letters.

            You don’t have to apply every threat like it’s calculus in a situation where there are people who are scared of even doing basic sums.

            This situation was hashtags. And all they are asking is to rehash it. And here you are already disposing of the 2nd feature after that.

            • AA5B@lemmy.worldEnglish
              1·
              4 days ago

              …second phone number…

              Of course but it doesn’t scale. I’m currently up to 182 unique generated email addresses to help keep my online accounts a little more secure. But they all go through one or two phone numbers, leaving me more open to sim attacks, social engineering and data aggregation

    • Eezyville@sh.itjust.worksEnglish
      3·
      6 days ago

      No one is safe from hackers. Everyone and every company will get hacked, it’s unavailable. What matters is how they react to the inevitable because that’s how best practices are made.

      • Phoenixz@lemmy.caEnglish
        1·
        4 days ago

        Eh, sorry, no.

        Yeah, it is extremely hard to make something impenetrable, but claiming blanket everyone will be hacked is nonsense too.

        If a company does IT well it will very unlikely fall victim as they’ll be a very hard target and not worth the time and money.

        When a company comes out with that they’ve been hacked you can bet dollars to donuts that they’ve neglected their IT department and infrastructure because the very vast majority of cases have shown that problem

        • Eezyville@sh.itjust.worksEnglish
          1·
          2 days ago

          I disagree. The weakest point in any and all organizations are the people who work for them. You can have the best IT infrastructure all you want but you cannot escape human error because we are not perfect and, by extension, anything we create is not perfect. Everyone will get hacked, don’t ever think you’re too perfect or you’re in so much control that you are immune.

    • Everyday0764@lemmy.zipEnglish
      3·
      6 days ago

      i had to argue with some friends that when a breach happen and the company did not do everything in they’re power to prevent it, then it is the company’s fault.

      They argued that bad actor should never do bad things, even it they are at hands reach.

      If a company exposes an s3 bucket with clients data publicly, the company is 100% at fault if someone discovers it and sell the data. ofc the guy would be liable too.

      • Phoenixz@lemmy.caEnglish
        2·
        3 days ago

        That’s like arguing that if a bank takes my gold to put in a security deposit box but then puts that box open out in the street. Of course the bank would be responsible for the theft.

      • hodgepodgin@lemmy.zipEnglish
        3·
        6 days ago

        It’s possible to use salts, peppers, and key stretching algorithms that repeatedly hash a password like 100,000 times. So yes, it’s possible to do so securely.

  • Zink@programming.devEnglish
    9·
    5 days ago

    I’m sure Plex has some great engineers, and Plex’s infrastructure is far more hardened and secure and reliable than my Jellyfin server.

    But they are a way way more likely target, and Jellyfin still performs far better and doesn’t try to sell shit to my family members.

    • muusemuuse@sh.itjust.worksEnglish
      5·
      5 days ago

      Plex is riskier just by having a cloud things phone home to. One target to hit that can affect multiple users.

      Depending on your use case, jellyfin may actually be more secure.

  • Vanilla_PuddinFudge@infosec.pubEnglish
    5111·
    6 days ago

    Huh, I guess centralizing all of that userdata was a bad idea. Weird. If you hack some dude’s Jellyfin, you just hack some dude and no one else.

  • moseschrute@lemmy.worldEnglish
    241·
    6 days ago

    I’m not a security expert, but password hashing is mostly to slow down someone from getting all the passwords. You can’t reverse the hash, but you can generate hashes until you find a match. When hashing, you can dial in how much compute it would take someone to try and solve all the hashes in your database. If you used a good password, it will be more difficult to solve your hashed password. But it’s best to change your password as Plex suggests.

    So it depends on how secure a password is and how strong of hashing Plex used when storing the hashed passwords. I have no idea if this is like a “this will take a year” or “this will take a billion years” to solve all the hashes. More compute also means you can solve the hashes faster. Maybe someone with a security background could chime in.

    • Phoenixz@lemmy.caEnglish
      91·
      6 days ago

      Not entirely

      Firstly you don’t “generate hashes until there is a match”. You can generate hashes until the end of the universe and you’ll still have only a fraction of all possible hashes.

      What typically is used are large lookup tables with hashes from known passwords. You can then take that table, take a hash you got, and look it up.

      So firstly, hashes should be salted, and if salted correctly, it’s already extremely much harder to use because these tables no longer work. There are few more things you can do but that pretty much is a hard wall already.

      The problem is that many corporate systems out there have horrible security. They either use a hash that has been known to be broken since a long time ago (hello LinkedIn), don’t use salting (hello linkediiiiiinn), or don’t use hashing at all.

      It’s because of idiots like these that there are so many accounts with password tables out there

      What to do?

      Use password managers. Now all your site’s have different, safe passwords and you only need to know one. Use 2FA where possible and supported

      • moseschrute@lemmy.worldEnglish
        3·
        6 days ago

        Can you also use a list of common passwords and a ruleset you apply to those common passwords, and then hash(applyRule(commonPassword), salt) == compromised hash ?

        • Phoenixz@lemmy.caEnglish
          2·
          3 days ago

          That’d basically how these hash tables work, they have the account and hash and known password so you can do rapid lookups

        • AA5B@lemmy.worldEnglish
          1·
          6 days ago

          I’m not entirely sure what you mean but my password manager alerts when the hash of one of my passwords matches one from a dark web data dump, and prompts me to replace it with a newly generated one.

          I’m sure it’s not a unique feature

          Admittedly I do have a few bad password, a combination of I don’t see how I could care (like a Reddit alt account) and sites that break the password change automation (yeah I’m lazy)

          • moseschrute@lemmy.worldEnglish
            2·
            6 days ago

            I wonder how that works. The point of password hashing is to uniquely scramble your password. So userOneHash(“password”) should give a different output than userTwoHash(“password”) even if they use the same password. So your password manager shouldn’t really be able to generate the same password hash since an infinite number of hashes can be generated from the same password.

            • Phoenixz@lemmy.caEnglish
              1·
              3 days ago

              A hash is just a mathematical algorithm that generates a somewhat unique number from any input, and usually in such a way that the tiniest difference generates a completely different hash.

              I can put a single letter in a hash, I can put the entire Bible in a hash, I can put the entire universe in a hash, the output is always the same amount of bytes.

              For example, if I have a hash algorithm that generates a two letter hash, a-z, then the input “Lemmy” could give me “WK” while “Lemmx” (literally one bit difference in binary) could give me “AV”. If I put the Bible in there, I could get out “XX”, for example.

              The same input always generates the same output, and another important tidbit: hashing is always one way, you can’t do it in reverse.

              Also important, as you probably already noticed: the hash contains (usually, but not necessarily) much less information than the original input. This means that at some point, two different inputs can generate the same output, that’s called a collision.

              If the entire world would use the same hash all the time, and users would all use the same password for every website, then all the hashes for all the websites would be the same.

              Now, humans are humans, and most humans use a fairly limited set of passwords. Sole people try to be ingentilent by replacing “s” with “5”, thinking that computers won’t get that.

              Then, somebody started compiling a list of all known passwords with all variations and put them in a table. Then they went over each password, and hashed it with a bunch of well known hashing algorithms. Those tables, called rainbow tables iirc, are super easy and fast lookup tables if you have a hash and want to see what password it could have been.

              Now what can websites do to protect against this? They can “salt” the password by prefixing then with a random text string only known to the website. If I download the database of that website, all the hashes will now be different and I won’t be able to do the lookup anymore. Better even would be to also include the user id in there, making it even harder to decipher.

              What can users do? Don’t use those “Kn0w13DgE” passwords, use a random string of characters. Use unique passwords for each site. Use a password manager which will do both for you so you won’t have to remember anything

  • ngwoo@lemmy.worldEnglish
    214·
    6 days ago

    Glad I never gave Plex any payment details, don’t reuse passwords, and don’t plan on using it any more so I can just ignore this

    • hackitfast@lemmy.worldEnglish
      9·
      6 days ago

      I bought a lifetime subscription years ago, and even if the payment method got decrypted, it’s well expired. Not to mention I haven’t had a Plex server running for ages.

      • ipkpjersi@lemmy.mlEnglish
        2·
        5 days ago

        Yep same here, I already got a brand new credit card with a brand new number because my renewal got stuck in a postal strike lmao

  • Toxuin@lemmy.caEnglish
    376·
    6 days ago

    Keep in mind that the only reason they deny you the ability to log in to your own local service with your own local sign-in method is that they may upsell you on their cloud junk. If there’d be no cloud account involved - your data would not be at risk and/or leaked. They endangered your privacy for marketing purposes.

    If you have not moved off of Plex - do it now. This company is fully rotten.

    The email they sent out has reply-to address that conveniently does not work…

    • Orygin@sh.itjust.worksEnglish
      44·
      6 days ago

      But brooo, don’t you know you need to have a cloud login. You neeeeeed it broo, so they can have all your info leaked bro. How else can I give access to somebody if I don’t pay 200+ bucks for the privilege of accessing my own library bro.
      Data leaks happen bro, no need to worry it’s the third time in a decade. This is a text book pro response anyway, they deserve more money bro.
      How dare you suggest people use another software bro, they deserve your money each month, not these leeches giving you free software. Plus Plex is so much more secure anyways, just look at them getting hacked bro. Your jellyfin is so insecure you need a PhD in cyber bro-security to even think about doing it. Look at all the jellyfin instances getting hacked every day. Someone could even guess a UUID and access 10s of playback of my pirates movie bro, see how it’s so full of holes bro

    • inclementimmigrant@lemmy.worldEnglish
      9·
      6 days ago

      End of the day does it even matter? They’ve gotten a ton of other information including authentication data which is probably just as, if not more, useful/lucrative to them.

      From another source:

      Server owners will also have to claim their server again and possibly update it, as Plex has also announced that it had “made adjustments” that will temporarily prevent “regular” users from connecting to any Plex server they have been granted access to.

      The reason given is that too many Plex Media Server instances have yet to be updated to version 1.42.1, which contains a fix for a vulnerability (CVE-2025-34158CVE-2025-34158) that could be exploited remotely by authenticated users to gain access to the server and tamper with it and the data on it.

    • Eh-I@lemmy.worldEnglish
      3·
      5 days ago

      Nevermind the credit cards, it’s the viewing habits they can sell that really make money.

  • Matty_r@programming.devEnglish
    9·
    6 days ago

    This isn’t the first time they’ve been breached, there was an incident in 2015 and 2022 as well. From what I can gather its the same info being gathered each time.

    There might be others but I can’t find th at the moment.

    • dogs0n@sh.itjust.worksEnglish
      21·
      6 days ago

      Really that often? I guess their good and quick response has been engineered through lots of experience…

      At some point, can you keep yourself using a service that constantly gets breached? I’d just be worried when the next one is coming, based on this record (that i havent verified for myself, gonna trust u bro).