Popular media-streaming service Plex has warned users of its forums that a breach has leaked their personal details, including names, email addresses and hashed passwords.
In an announcement made late last night, Plex support engineer Chris Curtis warned of the discovery of a breach into the company's forum server. 'At approximately 1pm PDT yesterday (July 1st) we learned that the server which hosts our forums and blog was compromised,' Curtis explained. 'The attacker was able to gain access to some personal information, such as IP addresses, forum private messages, email addresses, and encrypted (hashed and salted) passwords for our forum users.
'As a precaution, we reset the plex.tv passwords of all users with linked forum accounts and reached out via email with further instructions for those affected. At this time, our forums remain offline while we complete our investigation. All other systems are online and operational.'
Posts made to the Plex forums during the breach from someone identifying themselves as 'savaka' took responsibility for the attack, and claimed to have requested 9.5 Bitcoins from Plex to delete the data. A deadline of today was issued by the alleged attacker, after which the ransom would go up by a further 5 Bitcoins. 'Eventually,' 'savaka' claimed, 'if no BTC payment is made, the data will be released via multiple torrent networks and there will be no more plex.tv.'
While the breach is serious, its impact is somewhat mitigated by Plex's use of industry-standard password protection: all passwords stored in the database were both hashed with a non-reversible algorithm and salted, making the process of brute-forcing them significantly more difficult.
In an announcement made late last night, Plex support engineer Chris Curtis warned of the discovery of a breach into the company's forum server. 'At approximately 1pm PDT yesterday (July 1st) we learned that the server which hosts our forums and blog was compromised,' Curtis explained. 'The attacker was able to gain access to some personal information, such as IP addresses, forum private messages, email addresses, and encrypted (hashed and salted) passwords for our forum users.
'As a precaution, we reset the plex.tv passwords of all users with linked forum accounts and reached out via email with further instructions for those affected. At this time, our forums remain offline while we complete our investigation. All other systems are online and operational.'
Posts made to the Plex forums during the breach from someone identifying themselves as 'savaka' took responsibility for the attack, and claimed to have requested 9.5 Bitcoins from Plex to delete the data. A deadline of today was issued by the alleged attacker, after which the ransom would go up by a further 5 Bitcoins. 'Eventually,' 'savaka' claimed, 'if no BTC payment is made, the data will be released via multiple torrent networks and there will be no more plex.tv.'
While the breach is serious, its impact is somewhat mitigated by Plex's use of industry-standard password protection: all passwords stored in the database were both hashed with a non-reversible algorithm and salted, making the process of brute-forcing them significantly more difficult.
MSI MPG Velox 100R Chassis Review
October 14 2021 | 15:04
Want to comment? Please log in.