Plex Calls for Immediate Password Reset After New Breach

Plex has warned its users about a serious security lapse following unauthorised access to a database containing scrambled passwords and authentication details, urging swift action to protect accounts.

A database breach exposed a confined set of user data, including email addresses, usernames, and securely hashed passwords, along with authentication information. Plex assures that no credit card or payment data were compromised, as such information is not stored on its systems. The company stated that it has already addressed the vulnerability used in the breach and is conducting broader security audits.

Plex’s communication takes a firm tone: users are asked to reset their passwords immediately via the official reset portal and to enable the option to sign out of all connected devices. The company also recommends activating two-factor authentication for added security.

This incident marks a troubling reprise of a similar breach in 2022, which also exposed hashed passwords, usernames, and emails. That breach forced a mass password reset, and today’s event appears to echo that scenario.

Plex’s advisory emphasises that the password hashes were protected according to best practices, rendering them unreadable—but stresses that caution remains vital because sophisticated attackers might still attempt to crack them. The firm did not specify how many accounts were affected, nor provide details on the timing or duration of the breach.

In its messaging, Plex frames the password reset as a critical step—advising users to visit the reset form available on its site, sign out of all sessions, and reauthenticate on each device.

On user forums, reactions range from frustration at the recurrence of such incidents to appreciation for Plex’s proactive outreach. One user remarked that enabling multi-factor authentication and changing passwords is a straightforward precaution, while critics expressed concern over persistent vulnerability in Plex’s systems.