Plex data breach

yep. got the same notice. i'm going to check reddit to see if there's more info there.

get it together, plex. second time my server has been compromised in the last year.

Would this be an issue if we use google account to sign in?

quote:

---

Your server wasn't compromised in any way.

---

glad you're so on it.

my server was taken over by an email address in India. I was out of town at the time and had to let a friend in remotely to shut my PC completely down until I could get home and sort it out.

So you don't know WTF you are talking about.

Plex didn't even send an email to me asking to verify about the email address change. They just blindly switched it to AbCidett3234-354485@blah.in without even informing me.

I had to rebuild the entire server from scratch since the other user was busy deleting media when I caught it.

I even posted about it on here but keep on pretending you know me.

I take data breaches a little seriously at plex after that.

and yes i created a new very complex password and enabled 2-factor authentication since then but WTF plex. You didn't even send an email to my existing address asking if it was ok before you allowed someone else to hijack my server with a sketchy-arse email address?

quote:

---

Plex is forcing everyone to change their password and I don't know if I was trying to do it at the same time millions other were trying but it was not a smooth process. At all!

---

The password reset process is working better now than it was first thing this morning when all of America woke up and tried to do it at once.

quote:

---

Plex is forcing everyone to change their password

---

They haven't tried to force me yet. At least I don't think so. I just use my username to login.

quote:

---

had to rebuild the entire server from scratch since the other user was busy deleting media when I caught it.

---

Why would you allow Plex write access to your library? Should be mounted read only...

quote:

---

CAD703X

---

Check ya email sir

quote:

---

Plex didn't even send an email to me asking to verify about the email address change.

---

If you wanted Plex to verify both 1) your password and 2) your email address to modify settings, that's called 2 Factor Authentication.

quote:

---

yes i created a new very complex password and enabled 2-factor authentication since then but WTF plex

---

so you're running a server wide open to the internet, didn't have 2FA on, and someone got your password, and you're mad at plex for not checking 2 factors?

quote:

---

second time my server has been compromised in the last year.

---

nope

quote:

---

You: "my server was compromised" (present tense)

Me: "no it wasn't" (present tense)

You: "blah blah blah indian guy" (past tense)


Like seriously, wtf are you going on about?

---

coming from the fricking idiot who selectively cut my response.

I was pretty clear what happened the last time Plex screwed me but I understand if that's hard for you to follow along with.

quote:

---

It's running Plex server and I'm talking about their 2FA option to login into Plex, not 2FA on my PC. My computer doesn't have remote desktop running so nobody including me can log in except when I'm on my local network. What are you talking about?

---

I didn't say shite about remote desktop. You said someone breached your Plex account and was deleting media. Maybe I assumed too much but that sounds like someone logged into the Plex interface using your Plex account, which your server grants access to, and from there deleted media from your server. Sounds like shite security to me.