Original Release Date: 11/25/2019
The Disney+ video streaming service, launched on November 12, 2019, has suffered a data breach affecting thousands of accounts. At this time, credentials are available on dark web hacking forums for as little as $3. Users reported that they were locked out and their account credentials had been changed. Researchers assess that the ease with which hackers were able to access user credentials suggests that password re-use might be to blame. Hackers may have obtained username and password combinations through keyloggers, info-stealing malware, or most likely, previously breached credentials. Users are urged to never re-use passwords and enable multi-factor authentication (MFA) where available; however, Disney+ does not yet offer MFA at the time of this writing.