ROKU, INC.

Roku Inc. experienced a data breach affecting 15,363 individuals, including 76 Maine residents. The breach occurred from December 28, 2023, to February 21, 2024, and was discovered between January 4, 2024, and February 21, 2024. The incident involved unauthorized individuals using account credentials, believed to be obtained from third-party sources, to access customer accounts. Consumers were notified in writing on March 8, 2024. Identity theft protection services were not offered.

Affected (this filing): 15,363

Roku, Inc. notified the California Attorney General of unauthorized access to certain individual Roku accounts. The incident occurred between December 28, 2023, and February 21, 2024. Unauthorized actors used login credentials (email addresses and passwords) obtained from third-party data breaches to access Roku accounts. They changed login information and, in limited cases, attempted to purchase streaming subscriptions. Roku secured affected accounts by forcing password resets, investigated charges, and refunded unauthorized subscriptions. No SSNs or full payment account numbers were accessed.