Cyber Incident Victim: Plex
Date:
Jul 2015
Location:
United States of America
Summary
A breach of Plex's forum servers exposed user data including email addresses, IPs, private messages, and encrypted passwords. The incident affected forum account holders, with no compromise of payment information due to its absence on the servers. Mandatory password resets were enforced, and impacted users received direct notifications detailing the unauthorized access to their forum-related information.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On July 2, 2015, Plex disclosed a security breach affecting its forum servers. The compromise exposed IP addresses, private messages, email addresses, and encrypted forum passwords belonging to users with linked Plex forum accounts. The company confirmed financial data remained unaffected, as credit card and payment information was not stored on their compromised systems. Attackers gained unauthorized access to forum and blog hosting infrastructure, though Plex's investigation indicated no broader penetration into other systems. The breach specifically impacted users who had created forum accounts tied to their plex.tv credentials, with compromised passwords protected through hashing and salting techniques. Plex initiated immediate notifications via email to affected users, mandating password resets before restoring account access.
Plex enforced a compulsory password change workflow by redirecting logged-in forum users to credential reset pages. The company emphasized security precautions through its communications, advising adoption of strong unique passwords and password management tools like 1Password. While initial notifications lacked comprehensive breach details, Plex committed to publishing further information via its blog. Forensic analysis remained ongoing at the time of disclosure. The incident caused operational disruption for forum users, who lost account access until completing password resets. Plex characterized the forced resets as precautionary despite password encryption measures, prioritizing user security over convenience. No evidence suggested misuse of exposed data prior to containment.