The credentials, priced from free to $11 per account, appear to be due to victims' re-use of logins and passwords.

Dark Reading Staff, Dark Reading

November 19, 2019

1 Min Read

That didn't take long: stolen user accounts for the new Disney+ streaming service began appearing on Dark Web sites just hours after it went live on November 12.

ZDNet found some credentials for sale in the underground for $3 to $11 per account and others, for free, as attackers took advantage of users who share their accounts. Some victims were locked some out of their accounts entirely.

While no single mechanism for the credential theft has been identified, it seems that some victims re-used credentials from other sites — credentials that had previously been breached and posted on the Dark Web. Disney+ did not offer strong authentication options for its streaming service accounts.

"What is missing from the Disney+ security service is multi-factor-authentication," says Jonathan Deveaux, head of enterprise data protection at comforte AG. "MFA does not guarantee that only the authorized user is indeed accessing the service, but it does help slow down or reduce the likelihood of bad-actors gaining access with only user ID and password credentials."

Another factor is that some users opted for short or weak passwords for their accounts. "If you have ever had to enter a complex password on a streaming app, you can see why someone would want to use something easy," says Lamar Bailey, senior director of security research at Tripwire. 

As of today, Disney+ officials had no comment.

For more, read here and here.

Edgepromohorizontal.jpgCheck out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "How Medical Device Vendors Hold Healthcare Security for Ransom."

About the Author(s)

Dark Reading Staff

Dark Reading

Dark Reading is a leading cybersecurity media site.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights