Plex confirmed a security breach where an unauthorized party accessed one of its databases, exposing a subset of customer data. The compromised information included email addresses, usernames, and securely hashed passwords, though Plex emphasized that passwords were hashed per industry standards (algorithm undisclosed). While payment card data was not at risk—since Plex does not store such details—the incident marks the company’s second major breach in recent years, following a similar 2022 attack. Plex contained the breach swiftly and mandated password resets for all users, advising additional precautions like enabling two-factor authentication (2FA) and logging out of active sessions. The company fixed the exploited vulnerability but did not disclose technical specifics or remediation steps. The exposure of customer credentials raises risks of credential-stuffing attacks or phishing attempts, despite the hashing protection.