Plex Streaming Service Hit by Security Incident
Media streaming giant Plex has confirmed a significant data breach affecting its user database, forcing the company to mandate password resets for all customers. The security incident, discovered in early September 2025, marks the second major breach for the platform in three years.
Compromised User Data
According to the official breach notification, unauthorized actors gained access to a subset of Plex's customer database containing email addresses, usernames, and securely hashed passwords. The company emphasized that payment information remained secure as it is not stored on their servers.
'While we quickly contained the incident, information that was accessed included emails, usernames, and securely hashed passwords,' stated Plex in their security advisory.
Security Response and Recommendations
Plex has taken immediate action by addressing the vulnerability that allowed the breach and is recommending all users reset their passwords through the official password reset portal. Users should enable the 'Sign out connected devices after password change' option to ensure complete security.
For users utilizing Single Sign-On (SSO) authentication, Plex advises logging out of all active sessions through their security settings page. The company strongly recommends enabling two-factor authentication for enhanced account protection.
Historical Context and Industry Impact
This incident represents Plex's second major data breach, following a similar security event in August 2022 where authentication data and hashed passwords were also compromised. The recurrence raises concerns about the platform's security infrastructure and data protection measures.
According to cybersecurity experts, properly hashed passwords should provide substantial protection, but the specific hashing algorithm used by Plex remains undisclosed, leaving open the possibility of password cracking attempts by malicious actors.
The streaming service, which boasts millions of users worldwide for media organization and streaming capabilities, faces increasing scrutiny regarding its data protection practices as cyber threats continue to evolve in sophistication.