Pluto TV pluto.tv Pluto TV data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
In October 2018 the streaming service Pluto TV was breached and the data spread in hacking communities. It covers 3.2 million unique email addresses with IP addresses, names, usernames, genders, dates of birth and bcrypt-hashed passwords.
View all 13,118 breaches- Breach date
- 12 Oct 2018
- Affected
- 3,225,080
- Data exposed
- Dates of birth, Device information, Email addresses, Genders, IP addresses, Names, Passwords, Social media profiles, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In October 2018, the internet television service Pluto TV suffered a data breach, and the data was then shared widely in hacking communities. Have I Been Pwned added it on 5 December 2020, after it resurfaced.
Vice reported that Pluto TV decided not to proactively tell users about the breach. The company said it was communicating only with users who contacted it. That's why many people first heard about it two years later.
Sources checked: haveibeenpwned.com, vice.com, androidpolice.com
Last verified against the official page:
What was exposed
The data holds 3.2 million unique email addresses and IP addresses, plus names, usernames, genders, dates of birth, device information, social media profiles and passwords. The passwords were stored as bcrypt hashes. Bcrypt is a slow, deliberate way of scrambling passwords, so strong passwords are hard to crack. Weak and common ones still can be.
What it lets criminals do
A name, an email address and a date of birth are a good start for phishing and for impersonation on other services. If you reused your Pluto TV password elsewhere and it was easy to guess, someone could try it on your other accounts, which is called credential stuffing. Because the breach is from 2018, any password you used then is the one to worry about, even if you've changed it since.
What to do
Change your Pluto TV password if you haven't since 2018, and change it anywhere you used the same one. Then turn on two-factor login where it's offered.
What to do if you were in it
- 1
Change your Pluto TV password
Do it now if you still use a password from 2018 or earlier. Then change it on every other account where you used the same or a similar password.
- 2
Turn on two-factor login
Use an authenticator app or passkey on your email and other important accounts. It stops most takeovers even when a password has leaked.
- 3
Watch for phishing
Your name, email and date of birth leaked. Expect messages that look personal, and don't click links in them.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It checks breach databases for your email and phone number and shows which leaks they appear in.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was I affected by the Pluto TV data breach?
The data covers 3.2 million email addresses. Look up your email on Have I Been Pwned or run a free Serus scan to see whether it's included.
What was exposed in the Pluto TV breach?
Email addresses, IP addresses, names, usernames, genders, dates of birth, device information, social media profiles and passwords stored as bcrypt hashes.
Did Pluto TV tell users?
Vice reported that Pluto TV chose not to inform users proactively and only responded to people who contacted it.
Should I change my password?
Yes, if you used the same password as in 2018 anywhere. Hashed passwords are hard to crack but not impossible, especially weak ones.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
