Tiago Almeida was among the millions of users who signed up for Disney+. He just never expected to be sharing his account with a bunch of freeloading strangers.
For the past two days, Disney has been filling his email inbox with notifications signaling that unauthorized users have been trying to gain access to his account. "After midnight, I received like 30 notifications," he said.
Almeida can thank hackers. They've been posting valid login credentials for Disney+ accounts, offering them both for sale and for free. The news, which was first reported by ZDNet, highlights the shady world of password cracking. No, Disney+ didn't suffer a massive data breach. Nor were the login credentials necessarily stolen. Instead, the problems involve a cardinal sin facing IT security: password re-use.
That's what happened to Almeida; his Disney+ password was not unique. He uses it on other online accounts, which was how the hackers guessed his valid login credentials.
"Yes, that's my password," he said after we found his login credential in one of the Disney+ data dumps. "I'm going to need to change it."
It's no surprise Disney+ was hit with the account hijackings. For years now, hackers on shady forums and dark web marketplaces have been selling valid login credentials for other streaming services such as Netflix, Hulu, and HBO, often for only a few dollars per account.
Generally, the accounts are obtained thanks to people re-using old passwords for other internet services, according to Andrei Barysevich, CEO of security firm Gemini Advisory. And because websites are constantly getting breached, hackers can get access to entire troves of email address and password combinations, and then try them on a service like Disney+.
"If someone has a fresh database of email addresses and passwords for one million users, maybe only 1 percent will work, but that's still 10,000 users affected," he said.
The hackers can test which logins work by using software-based hacking tools, such as Sentry MBA, which can automate the password entry process. "You can click a start button, and by the next morning, you'll have a 100 or 1,000 valid accounts," Barysevich added.
It also helps that the streaming services can be lenient when it comes to password sharing. As a result, hackers can get away with selling the valid credentials, often without the account holder even aware. "It's not so damaging," he said. "Nobody can use a Hulu account to buy a $2,000 laptop on Amazon."
"But the criminals now know that the specific email address and password combination works," Barysevich added. "So they could leverage it again to target more sensitive online accounts, like at a bank."
As for Almeida, he originally signed up for Disney+ for his own personal use. But on Tuesday, he told PCMag he noticed strangers creating three additional user profiles on his account.
Recommended by Our Editors
Although Almeida has changed his password, he's still receiving notifications from Disney about the unauthorized access attempts. Specifically, the emails from Disney relate to a security measure the company has implemented to stop the hijackings. It requires the user to first type in a one-time passcode delivered to the account holder's email inbox in order to gain full access to Disney+.
The repeated notifications and news of the account hijackings is why Almeida decided to cancel his account with the streaming service. "I think I will (try Disney+ again), but they need to figure out what's happening," he said. "I really like it, but the hacking stuff. They need to figure out how to fix it."
Almeida isn't the only user who's received the notifications. PCMag spoke with another victim of the account hijackings who also had her email address and password in a Disney+ account dump.
"That is my password and email and I agree that I think I have been hacked," the user said. "I keep getting emails containing a one time passcode that I'm not requesting. I have actually canceled my account three days ago, but I'm still getting emails as late as 2:30 (pm) today."
The same user said her Disney+ password was not used anywhere else. ZDNet also found cases of users saying their Disney+ passwords were unique. This may mean the hackers are also obtaining the passwords in other ways, such as keylogging malware.
Some of the valid login credentials are also freely available over the open web through postings hackers have made in forums. According to Barysevich, this is done so that the hacker can build up a reputation in the hopes of selling other password dumps in the future.
Although the account hijackings may sound worrisome, for perspective, you can actually find more login credentials for Netflix, Hulu, and HBO being sold by hackers than over Disney+, Barysevich added. "We're looking at only five or six bad actors targeting Disney versus 200," he added. But that may change over time as Disney's streaming service becomes more popular and rolls to more countries.
In a statement, Disney simply told PCMag: "Disney takes the privacy and security of our users' data very seriously and there is no indication of a security breach on Disney+."