Disney+

NJCCIC Data Breach Notification

Original Release Date: 11/25/2019

Summary

The Disney+ video streaming service, launched on November 12, 2019, has suffered a data breach affecting thousands of accounts. At this time, credentials are available on dark web hacking forums for as little as $3. Users reported that they were locked out and their account credentials had been changed. Researchers assess that the ease with which hackers were able to access user credentials suggests that password re-use might be to blame. Hackers may have obtained username and password combinations through keyloggers, info-stealing malware, or most likely, previously breached credentials. Users are urged to never re-use passwords and enable multi-factor authentication (MFA) where available; however, Disney+ does not yet offer MFA at the time of this writing.

New Jersey Cybersecurity & Communications Integration Cell

2 Schwarzkopf Dr, Ewing Township, NJ 08628

njccic@cyber.nj.gov

OUR COMMITMENT

The NJCCIC is a component organization within the New Jersey Office of Homeland Security and Preparedness. We are the State's one-stop-shop for cyber threat analysis, incident reporting, and information sharing and are committed to making New Jersey more resilient to cyber threats by spreading awareness and promoting the adoption of best practices.

Agency Seals of State of NJ, NJOHSP and NJCCIC

STAY CONNECTED:

View our Privacy Policy here.

View our Site Index here.