clock menu more-arrow no yes

Filed under:

Plex's forum data is being held for ransom

New, 45 comments

The movie streaming service Plex has been hacked, with an attacker attempting to hold the service for ransom, according to an email sent out to subscribers earlier today. The hackers claimed to have gained control of the server hosting user forums, and demanded a bitcoin payment to prevent the full release of the server's data. Plex confirmed independently that the server housing its forum and blog had been compromised, but said any associated passwords were hashed and salted, making them unusable without serious and sustained decryption efforts. The service declined to pay the ransom, automatically resetting passwords for any affected users.

"I gave them until the 3rd of this month to send 9.5 BTC," said the attacker in a message posted to Plex's hacked forum. "This ransom is still active and on the 3rd: if no BTC payment is made, the ransom wll go up by 5 BTC. Eventually if no BTC payment is made, the data will be released via multiple torrent networks and there will be no more plex.tv."

Given the advance warning of the breach, it's unlikely users will be exposed to unauthorized charges or more comprehensive attempts at identity theft. The greatest threat is if users have repeated those passwords at other, more sensitive accounts, which might now be targeted by attackers after the salting is cracked. Still, it's a crucial reminder to use separate passwords for each account and change passwords as frequently as possible. It's also unwelcome news for Plex, which had recently inked partnerships with Tivo and Playstation, after rolling out new audio features earlier this year.

Correction 6:14pm ET: An earlier version of this post overstated the extent of the breach, which extends only to the server hosting the forum and website, and does not involve unencrypted passwords. The Verge regrets the error.