Last March, Roku also suffered a security hack that exposed more than 15,000 accounts.

In a statement, Roku said there was no indication that the company was the source of account credentials used in either of the attacks or that Roku's systems were compromised.

Roku said login credentials used in these attacks were taken from another source, "like another online account" where the affected users may have used the same credentials.

According to a CBS report, the cyberattack is known as "credential stuffing."

"In less than 400 cases, malicious actors logged in and made unauthorised purchases of streaming service subscriptions and Roku hardware products using the payment method stored in these accounts, but they did not gain access to any sensitive information, including full credit card numbers or other full payment information," Roku said.

Roku downplayed the number of accounts affected, saying it represents "a small fraction of the company's more than 80 million active accounts."

Roku said it will implement several controls and countermeasures to detect and deter future credential stuffing incidents.

It reset passwords for all affected accounts and notified those customers about the incident. It sent a verification email to users.

Roku is also refunding or reversing charges in the accounts that purchases made by unauthorised actors.

It also enabled two-factor authentication, for even those who have not been impacted by the security incident.

Roku advised users to create a strong and unique password. It urged users to be alert to any "suspicious communications appearing to come from Roku, such as requests to update your payment details, share your username or password, or click on suspicious links."

"When in doubt over the authenticity of a communication, contact Roku customer support," it said.

"In closing, we sincerely regret that these incidents occurred and any disruption they may have caused. Your account security is a top priority, and we are committed to protecting your Roku account."

This first appeared in the subscription newsletter CommsWire on 16 April 2024.