Account hacked

[Thappers]

Last night somebody hacked into my Plex account and made a payment through Paypal for a lifetime subscription.

I received an email from Plex letting me know the account details had changed and so I immediately changed them back using the recovery code, changed passwords etc. and opened a case with PayPal to try and claw back the money. Not that a lifetime subscription would be a bad thing, just that I’d rather be the person authorising it than some spotty little hacker!

The email address used in the hack was [deleted by mod]

I think Plex should add some form of additional security to their payments system since many of us have linked PayPal accounts. 2FA perhaps, but at the very least when an account has just had its email address changed and is logged in from an unknown IP address it shouldn’t be allowing large payments to go through unquestioned. Here’s hoping I can get that money back…

[OttoKerner]

Please contact https://www.plex.tv/contact/?option=plex-pass-billing for a refund.

[NewPlaza]

@Thappers

Here’s hoping I can get that money back…

I’m sure they will be happy to refund you the money.

In the interim, this feature request may interest you.

[implemented] Two Factor Authenticator for Plex account

I believe that two factor authenticator is needed especially in something as plex where someone can delete your library and or gain access to sensitive picture (picture of your kids and family or such) if the password is compromised in some way, There are two possible implementation: 1: Authentication via email, By accessing from an unknown device and or network you get an email with a link inside to ‘‘authorise’’ this new address, 2: (Preferred) Use of a classical TOTP via software (e,g goog…

[Thappers]

thanks, yes I think that’s exactly what needs to be implemented.