Thousands of Disney+ accounts hijacked

Hackers exploited the video streaming service just hours after it launched

Hackers began hijacking thousands of Disney+ user accounts just hours after the service launched, to resell on hacking forums. 

ZDNet investigation discovered many of the hacked accounts are available for free on hacking forums, or are being sold for $3 to $11 (though a legitimate subscription is only $7). 

After its launch in the US, Canada, and the Netherlands on November 12, Disney+ attracted 10 million customers in the first 24 hours. The traffic impeded video streaming speeds, and many users were unable to access their favorite movies and shows.

Amidst the flood of technical complaints, other users began reporting a total loss of access to their accounts. The reports, posted to social networks like Twitter and Reddit, described online attacks in which hackers logged users out of their accounts on every device and changed the account's email and password to lock the previous owner out.

In some cases, reported anonymously to ZDNet, users reused passwords for their Disney+ accounts, meaning hackers could have gained access by using email and password combinations leaked at other sites. Others, however, used unique passwords, suggesting credentials may have been obtained through keylogging, a program that records a computer user's keystrokes, or info-stealing malware.

Thousands of hijacked Disney+ accounts are now up for sale, but some are being offered to the hacker community for free using the streaming service's account sharing function.

Other streaming services have been exploited in the same way; Amazon Prime, Hulu, and Netflix accounts are still being bought and sold on hacking forums all the time.

One way Disney+ could beef up security for their users would be to use a multi-factor authentication process to log in. This would prevent attacks relying on password credentials. Users should also create unique passwords for their accounts, but that won't protect them from malware.

Disney did not respond to IT Pro's request for details on the streaming service's current security measures at the time of publication.

Featured Resources

2021 Thales access management index: Global edition

The challenges of trusted access in a cloud-first world

Free download

Transforming higher education for the digital era

The future is yours

Free download

Building a cloud-native, hybrid-multi cloud infrastructure

Get ready for hybrid-multi cloud databases, AI, and machine learning workloads

Free download

The next biggest shopping destination is the cloud

Know why retail businesses must move to the cloud

Free Download

Recommended

Malware developers create malformed code signatures to avoid detection
malware

Malware developers create malformed code signatures to avoid detection

24 Sep 2021
New malware uses search engine ads to target pirate gamers
malware

New malware uses search engine ads to target pirate gamers

21 Jul 2021
Nigerian cyber criminals target Texas unemployment system
cyber security

Nigerian cyber criminals target Texas unemployment system

27 May 2021
Hackers use open source Microsoft dev platform to deliver trojans
Security

Hackers use open source Microsoft dev platform to deliver trojans

14 May 2021

Most Popular

Best Linux distros 2021
operating systems

Best Linux distros 2021

11 Oct 2021
Apple MacBook Pro 15in vs Dell XPS 15: Clash of the titans
Laptops

Apple MacBook Pro 15in vs Dell XPS 15: Clash of the titans

11 Oct 2021
Apple iPad (2021) review: The best entry-level iPad
tablets

Apple iPad (2021) review: The best entry-level iPad

12 Oct 2021