Account Hacked & Recovered — Users & Sharing Missing Despite Active Lifetime Plex Pass

Plex Media Server
1

Platform: Windows (accessing via 127.0.0.1:32400)
Plex Pass: Lifetime (confirmed active on account page)
What happened:
My Plex account was compromised. The attacker changed my email and password, deleted all my managed user accounts, and added themselves as a new admin on my server. I have since recovered my account by resetting the email and password back to mine.
Current situation:
I can access my server locally via 127.0.0.1:32400 ✓
My media libraries are intact ✓
Lifetime Plex Pass shows active on plex.tv ✓
“Users & Sharing” is completely missing from server settings ✗
What I’ve already tried:
Signed the server out and back in with my account
Hard refreshed the browser
Restarted the Plex Media Server service
Checked plex.tv directly — Plex Pass is confirmed active
What I think is happening:
The server may still be associated with the attacker’s account at the token level, which is preventing my Plex Pass entitlements from being recognized even though my account shows the Lifetime subscription.
Can anyone help me verify the server is fully re-claimed under my account and get Users & Sharing back? Should I also contact security@plex.tv given this was an account takeover?

2

Please contact billing support https://www.plex.tv/contact/?option=billing-issues

3

Would you mind sharing how you think the account takeover took place?

4

I have no clue, nothing else seems compromised. My PC, Server, Email all seem to be fine just the plex account. I didn’t have any phishing emails or anything like that. I just got an email that there was a new login from

Location: New York City, New York, United States (estimated)
IP address: 74.64.242.43

Then shortly after
Location: Shibin al Kawm, Al Minufiyah, Egypt (estimated)
IP address: 156.199.118.96
Probably a VPN Then I got an email that my account email has been changed to elmasryelnahas@icloud.com

Google says
“Elmasry el nahas” is a combination of two common Arabic terms that translates to “The Egyptian Coppersmith”

5

Use the link in that email to revert the change, if you can. If not, use the above contact link.