The Maine Office of the Attorney General disclosed a data breach affecting Roku Inc. between December 28, 2023, and February 21, 2024. Unauthorized actors accessed approximately 15,363 user accounts by exploiting credentials likely obtained from third-party sources (e.g., credential stuffing attacks). While the exact types of compromised data were not detailed, the incident confirmed that no highly sensitive information—such as Social Security numbers—was exposed. The breach highlights vulnerabilities in account security, particularly where users reuse passwords across platforms. Roku responded by notifying affected individuals and advising password resets, though the long-term reputational and operational impacts remain limited. The attack did not involve ransomware, direct financial fraud, or systemic disruptions to Roku’s services, but it underscores risks associated with credential-based intrusions and the importance of multi-factor authentication (MFA).