HackingTechnologyInformationStolen CredentialsCustomer Data InvolvedCredentialsIdentity (basic)LowContained

ROKU, INC.

bd_58e489ed0f5d0b52 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Mar 8, 2024

To disclose

—

Affected

Not disclosed

Linked

3 filings

Confidence

65%

Full breach record for ROKU, INC. →2 incidents on file

Roku, Inc. notified the California Attorney General of unauthorized access to certain individual Roku accounts. The incident occurred between December 28, 2023, and February 21, 2024. Unauthorized actors used login credentials (email addresses and passwords) obtained from third-party data breaches to access Roku accounts. They changed login information and, in limited cases, attempted to purchase streaming subscriptions. Roku secured affected accounts by forcing password resets, investigated charges, and refunded unauthorized subscriptions. No SSNs or full payment account numbers were accessed.

J jump to incidentP pin to compareR raw source

Incident timeline

Dec 28, 2023

Begins

Mar 8, 2024

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Maine State AGbd_49c6d0ded27361a12024-03-08Verified
Indiana State AGbd_7d1c041465f60e1d2023-12-28 · +71dCandidate

Name: ROKU, INC.
norm: roku

Name: ROKU, INC.
norm: roku
Industry: Technologyllm

Discovered: —
Breach occurred: Dec 28, 2023 – Feb 21, 2024
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: CredentialsIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Secured the accounts from further unauthorized access by requiring the registered account holder to reset the password
Investigated account activity to determine whether the unauthorized actors had incurred any charges
Took steps to cancel unauthorized subscriptions and refund any unauthorized charges
Continues to actively monitor for signs of suspicious activity
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGDec 28 · first

Maine State AG+71d

California State AG+71d · this page

Pattern: first filing Dec 28 (IN), last Mar 8 (CA) — a 71-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-582208
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 8, 2024
Raw hash: 35d806336e087dd038f3a9df02929c7c31666271c87f1876ea49535dd0cbf764

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityROKU, INC.

Victim entityROKU, INC.

IncidentUnauthorized Access

Stated responseSecured the accounts from further unauthorized access by requiring the registered account holder to reset the password

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov