Technology
Is your Roku safe? Massive data breach exposes thousands of accounts
Hackers have stolen data from at least 15,363 Roku users, including credit card information, passwords and more.
According to Roku officials, hackers used information from third-party sources to break into accounts. They then sold user data for just $0.50 per account, according to BleepingComputer.
This effectively lets anyone who wants to pay 50 cents use the credit card stored in the account.
While Roku says they have secured affected accounts, you can still take steps to ensure your safety.
CLICK TO GET KURT’S FREE CYBERGUY NEWSLETTER WITH SECURITY ALERTS, QUICK VIDEO TIPS, TECH REVIEWS AND EASY HOW-TO’S TO MAKE YOU SMARTER
Roku stuffing attack
According to Roku, hackers obtained usernames and passwords from a third party. This is called a password stuffing attack. Hackers will try to use those logins on several websites, hoping to get your personal information. Once they do break into your account, your credit card information, shipping address, email, and password are all susceptible.
FRENCH GOVERNMENT HIT WITH ‘UNPRECEDENTED’ WAVE OF CYBERATTACKS
Roku has secured accounts and forced password resets on affected accounts. The company also investigated for fraudulent charges, canceled subscriptions and issued refunds to defrauded users.
MORE: HOW TO FIND OUT WHO’S SPYING ON YOU
Someone else is controlling my Roku
We often hear of people wondering how someone else nearby can get access to their Roku device. Channels may change unexpectedly, content can be cast onto the Roku or the previously viewed shows may not be recognizable. If this happens, in addition to locking down your wireless home network and following advice in the next section, check your Roku settings for anything unusual. Here’s how.
- On the Roku remote, press the home button to go to the main screen
- Select “Settings,” then System, find Screen Mirroring, and make sure “none” is selected for others having permission to stream content to your Roku
- Next, do the same for Remotes by selecting Remotes & Devices from the Settings menu. Unless you have permitted others, you should not see any other remote control devices connected except yours
- Now check the Guest Mode by clicking Guest Mode from the Settings menu. Make sure no other people are shown — who may have access to your Roku in Guest Mode
- Finally, from the Settings menu, select System, then Advanced System Settings. Click Control by mobile apps and make sure you see either “default” or “disabled” selected so that no one else is using a mobile app to control your Roku
Data on a computer. (Kurt “CyberGuy” Knutsson)
MORE: HOW TO PROTECT YOURSELF FROM STREAMING HACKS
Roku’s response to the hack
Roku announced the breach in a public memo sent to customers dated March 8, citing various information on what happened and what the company is doing to combat the issue:
“We are committed to maintaining the privacy and security of your Roku account and we are taking this incident very seriously. When we identified potentially impacted Roku accounts, we secured the accounts from further unauthorized access by requiring the registered account holder to reset the password, we investigated account activity to determine whether the unauthorized actors had incurred any charges, and we took steps to cancel unauthorized subscriptions and refund any unauthorized charges.
“We did not delay notification as a result of a law enforcement investigation, and we are providing this letter to notify you about these issues, to provide information about how you can further protect yourself, and to let you know that we are continuing our investigation to identify any additional appropriate steps. Finally, our team continues to actively monitor for signs of suspicious activity, to ensure that all customer information and data is kept secure.”
What to do if you’ve been hacked
If it has already happened and you’ve been hacked, then you should take immediate action to minimize the damage and secure your device. Here are some steps that you can follow.
Change your Roku passwords
If hackers have recorded your passwords, they could access your online accounts and steal your data or money. ON ANOTHER DEVICE (i.e., your laptop or desktop), you should change your passwords for all your important accounts, such as email, banking, social media, etc. You want to do this on another device, so the hacker isn’t recording you setting up your new password on your hacked device. And you should also use strong and unique passwords that are hard to guess or crack. You can also use a password manager to generate and store your passwords securely.
Enable two-factor authentication: You’ll want to activate two-factor authentication for an extra layer of security.
Monitor your accounts and transactions
You should check your online accounts and transactions regularly for any suspicious or unauthorized activity. If you notice anything unusual, report it to the service provider or the authorities as soon as possible. You should also review your credit reports and scores to see if there are any signs of identity theft or fraud.
Use identity theft protection
Identity Theft protection companies can monitor personal information like your home title, Social Security Number (SSN), phone number and email address and alert you if it is being used to open an account. They can also assist you in freezing your bank and credit card accounts to prevent further unauthorized use by criminals. See my tips and best picks on how to protect yourself from identity theft.
Contact your bank and credit card companies
If hackers have obtained your bank or credit card information, they could use it to make purchases or withdrawals without your consent. You should contact your bank and credit card companies and inform them of the situation. They can help you freeze or cancel your cards, dispute any fraudulent charges and issue new cards for you.
Alert your contacts
If hackers have accessed your email or social media accounts, they could use them to send spam or phishing messages to your contacts. They could also impersonate you and ask for money or personal information. You should alert your contacts and warn them not to open or respond to any messages from you that seem suspicious or unusual.
Hacker on a computer. (Kurt “CyberGuy” Knutsson)
MORE: HACKERS USE PIRATED SOFTWARE TO HIJACK MAC, ANDROID AND WINDOWS DEVICES
Kurt’s key takeaways
Who knew hackers could snag your info for less than a cup of coffee? The good news is Roku took action and locked things down. Plus, we now have a game plan to keep our accounts extra secure. Remember, the key is making it as tough as possible for hackers. Strong passwords, two-factor authentication — that kind of stuff. And keeping an eye on your accounts for anything fishy. If you think you’ve been hacked, don’t panic. Just follow the steps we discussed — changing passwords, checking accounts and contacting your bank.
Do you think streaming services have a responsibility to do more to protect user data? Why or why not? Let us know by writing us at Cyberguy.com/Contact
For more of my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter
Ask Kurt a question or let us know what stories you’d like us to cover.
Answers to the most-asked CyberGuy questions:
Copyright 2024 CyberGuy.com. All rights reserved.
Technology
Google’s latest Pixel Watches have fallen to their lowest prices ever
With longer days and warmer weather on the way, it’s a good time to take your gym routine outside. Luckily, Google’s Pixel Watch 4 can help you track all your outdoor fitness activities, and right now it’s on sale at Amazon, Best Buy, and Target starting at $289.99 ($60 off), a new low price. The last-gen Pixel Watch 3 is also currently the cheapest it’s ever been, with the 41mm / Wi-Fi configuration selling for $169.99 ($80 off) — also a new low — at Amazon, Best Buy, and Target.
The Pixel Watch 4 is our favorite Fitbit-powered smartwatch, one that offers a great feature set for the price. Google’s latest wearable features dual-frequency GPS, which improves accuracy in challenging environments such as cities and dense forests, and it can automatically record certain cardio activities on your behalf, including both running and cycling. It also offers improved sleep tracking, satellite SOS (on the LTE model), and a slew of AI features courtesy of Gemini — including an exclusive raise-to-talk gesture that’s useful while on a run.
The hardware has improved as well. Most notably, you can now replace and repair both the screen and the battery, making it a better long-term investment. The display is bigger and brighter, too, and the Pixel Watch 4 lasts about a day and a half on a single charge, or roughly 45 hours if you buy the 45mm model (up from 32 hours on the Watch 3). Charging is also faster, allowing you to charge it up to 80 percent capacity in under 30 minutes. And as a nice little extra, the included side-mounted charger lets you use the watch as a glanceable display, so you can see the battery percentage and other useful tidbits of info more easily.
If you want a great Android smartwatch for less, the last-gen Pixel Watch 3 is also a good option. While it’s not easily repairable like the Watch 4 and lacks some of the aforementioned upgrades (including dual-frequency GPS), it still offers a good set of health and fitness tools, allowing you to track your activity, sleep, blood oxygen levels, and heart rate. It also supports Gemini and integrates well with Google’s various services, letting you download offline maps and leave your wallet at home by paying via Google Wallet. You can even use it to control a slew of compatible devices from your wrist, from Nest cameras and video doorbells to the newest Google TV devices.
Technology
You could be sharing your Social Security number when you don’t need to
NEWYou can now listen to Fox News articles!
Some Social Security number requests are not optional. Federal reporting systems rely on the SSN as a primary identifier.
Employment offers the clearest example. Employers collect your SSN to report wages and file taxes, including Form W-2 submissions. The Social Security Administration credits your earnings record with it. The IRS uses it to match payroll taxes with reported income. Federal agencies also require your SSN when you apply for certain benefits or meet tax obligations. If you refuse to provide your SSN in these situations, you can delay processing or lose access to services.
However, not every form carries that authority. Landlords, medical offices, schools, gyms and retailers often include an SSN field by default. In those cases, ask why they need it and whether another identifier will work. So how do you tell when your SSN is truly required and when you can push back?
Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.
Your Social Security number powers tax reporting and federal benefit systems, which is why some requests truly are mandatory. (AP Photo/Jenny Kane, File)
Examples of when you need to share your SSN
Certain U.S. laws and federal regulations require an SSN because it functions as the official taxpayer or benefits identifier.
Federal income tax returns: The IRS requires individuals who qualify for an SSN to use it as their taxpayer identification number on Form 1040 and related filings. The IRS uses the number to match income statements, credits and refunds to the correct taxpayer record.
Form W-2 wage reporting: IRS regulations require employers to include each employee’s SSN on Form W-2. Employers submit the form to both the IRS and the SSA so agencies can record earnings and reconcile payroll taxes.
Social Security retirement and disability benefits: Applications for Social Security benefits require an SSN so the SSA can retrieve the applicant’s earnings history and calculate eligibility and payment amounts.
ILLINOIS DHS DATA BREACH EXPOSES 700K RESIDENTS’ RECORDS
FAFSA for federal student aid: U.S. citizens and eligible noncitizens applying for federal student aid must provide a valid SSN on the Free Application for Federal Student Aid (FAFSA). The number is verified against SSA records during processing.
Interest income reporting: Financial institutions must obtain a taxpayer identification number — usually an SSN for individuals — to report interest income to the IRS on Form 1099-INT.
In each of these cases, the requirement stems from tax administration statutes or federal benefits law. The SSN is used to link records across agencies and systems.
When you don’t need to share your SSN
Beyond tax filings, wage reporting and federal benefits, many SSN requests come from internal company policy rather than statute. Private businesses are generally allowed to ask for your SSN. In most everyday transactions, there is no federal law forcing you to provide it.
Rental applications: Landlords often request an SSN to run credit checks. Federal housing law does not mandate collecting a tenant’s SSN to lease property. Screening is conducted through consumer reporting agencies, and alternative verification methods may be available.
Medical intake forms: Healthcare providers routinely include an SSN field. Federal law does not require patients to disclose an SSN for treatment. Since 2018, Medicare cards have used randomized beneficiary identifiers instead of SSNs. These Medicare Beneficiary Identifiers (MBI) don’t include your SSN.
School enrollment forms: Public schools may request a student’s SSN, but students cannot be denied enrollment for refusing to provide one. Institutions tend to assign their own identification numbers.
TAX SEASON SCAMS 2026: FAKE IRS MESSAGES STEALING IDENTITIES
Utilities and subscription services: Power companies, mobile carriers and gyms sometimes request an SSN to evaluate credit risk or secure payment agreements. This is a risk management choice, not a statutory requirement.
In these cases, the request may feel routine. The legal footing is different from tax or benefits administration. You can ask what authority requires it and whether another form of identification will suffice.
Not every form that asks for your SSN has legal authority behind it. Many requests are simply company policy. (Kurt “CyberGuy” Knutsson)
What to ask before you hand over your SSN
If the request comes from a government agency, look for a Privacy Act disclosure statement. Federal law requires agencies to state whether providing your SSN is mandatory or voluntary, cite the legal authority for the request, and explain how it will be used. If the request comes from a private company, ask direct questions:
Is this required by federal or state law?
What will the SSN be used for?
Can you accept the last four digits instead?
Is there an alternative way to verify identity?
You can also ask how the number will be stored, whether it is encrypted and who has access to it. Collecting only what is necessary is a recognized security practice, but not every organization follows it.
What actually happens when your SSN is leaked
A leaked or stolen SSN can be used anywhere that number is treated as proof of identity.
In tax administration, the IRS processes returns based on the SSN attached to them. If a fraudulent return is filed first, the legitimate taxpayer’s electronic filing may be rejected because the number has already been used. Fixing it means paper filing and identity verification while the IRS reviews the case. The agency’s Identity Protection PIN program was introduced after years of SSN-based tax fraud.
Credit reporting works the same way. Under the Fair Credit Reporting Act framework, credit bureaus use the SSN to build and match consumer files. If credit is issued using your SSN, that account can attach to your report until you dispute it. It stays there while bureaus and lenders investigate.
Federal benefit systems also depend on the number. The SSA warns that criminals use stolen SSNs to impersonate beneficiaries and create fraudulent online accounts. An SSN does not expire or reset. Once exposed, it can continue appearing in tax filings, credit applications, or benefit records until you flag it.
How identity monitoring services help you respond faster
Identity monitoring services attempt to detect suspicious activity tied to your personal information as early as possible. Many services track credit activity across all three major U.S. bureaus and alert you to new inquiries, accounts and report changes. Some also scan known data breach datasets for exposed identifiers, including Social Security numbers.
Certain plans include identity theft insurance to cover eligible recovery costs, along with fraud resolution support to guide you through disputes and paperwork if something goes wrong.
No service can prevent every type of identity theft. The real value is early warning, knowing when and where your SSN is being used so you can act quickly before damage spreads.
How to check if your personal information was exposed
If you are unsure whether your personal information has been compromised, take action. Start with a reputable breach scan to see whether your email or other identifiers appear in known leaks. Early detection gives you more control and helps you respond before fraud escalates.
See my tips and best picks on Best Identity Theft Protection at Cyberguy.com.
Before handing it over, ask how your SSN will be used, stored and protected. That simple pause can reduce your risk. (Kurt “CyberGuy” Knutsson)
Kurt’s key takeaways
Lawmakers created the Social Security number to track earnings and administer benefits, not to unlock every part of your life. Yet today, many companies treat it like a universal key. In some situations, you must provide your SSN. Taxes, employment and federal benefits depend on it. However, many everyday requests come from internal company policies, not federal law. That distinction matters. Before you share your number, pause and ask why the business needs it. Ask how they store it. Ask whether another form of identification will work. Small questions can prevent big problems. If someone has exposed your SSN, act quickly. Monitor your credit. Set up alerts. Report suspicious activity right away. Early action limits damage and protects your identity. Your Social Security number does not change. But you control when, where and how you share it.
Have you ever been asked for your Social Security number in a situation that didn’t feel necessary, and did you push back? Let us know by writing to us at Cyberguy.com.
CLICK HERE TO DOWNLOAD THE FOX NEWS APP
Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.
Copyright 2026 CyberGuy.com. All rights reserved.
Technology
Apple is going high-end with new ‘Ultra’ products next
Fresh off launching the low-cost MacBook Neo, Apple is reportedly preparing at least three new products that will fit into its highest-end “ultra” lineup. According to Bloomberg’s Mark Gruman, the next batch of releases may not bear the “ultra” name, like its Watch, but will all command price premiums over their mainline counterparts.
There’s the oft-rumored foldable iPhone, which is expected to cost around $2,000, and a touchscreen MacBook Pro is supposedly slated for the fall. Those are pretty straightforward plays for the higher end of the market. More interesting are the next-gen AirPods, which are rumored to include cameras to feed visual context to Siri. Since AirPods already use the Pro and Max branding, similar to Apple Silicon, a set of AirPods Ultra could very well be on the docket.
Between the Neo and multiple foldables in the works, it seems that Apple is simultaneously trying to go further up- and down-market.
-
Wisconsin1 week agoSetting sail on iceboats across a frozen lake in Wisconsin
-
Massachusetts6 days agoMassachusetts man awaits word from family in Iran after attacks
-
Maryland1 week agoAM showers Sunday in Maryland
-
Florida1 week agoFlorida man rescued after being stuck in shoulder-deep mud for days
-
Pennsylvania4 days agoPa. man found guilty of raping teen girl who he took to Mexico
-
News1 week ago2 Survivors Describe the Terror and Tragedy of the Tahoe Avalanche
-
Sports5 days agoKeith Olbermann under fire for calling Lou Holtz a ‘scumbag’ after legendary coach’s death
-
Virginia5 days agoGiants will hold 2026 training camp in West Virginia