Action required: Important notice of a potential data breach

This is a prime example of why I loathe systems that are too automated. Give me the option to reset things manually instead of relying on auto detection and resolution.

What good is two source verification if someone can still get access? I prefer to have the second source send me an email to verify the source.

After much confustion, got it going with my couple of PMS machines. Assuming you got the password change confirmed and completed, you have to access the PMS via a browser using the IP Address of the PMS, i.e. http://10.10.10.1:32400/web/index.html#!/
Did a restart of the PMS service on the machine after the password reset.
Click General, then Claim Server. Will take 10 or 20 seconds. Do the same for each PMS.
I’ve got AD DNS in the home so I have names for everything. So much for following best practice there Plex.

I have the same issue, After a lot of retries, I have managed to reset my password but not connect to my Synology NAS. Says off-line. I am remote from my server and upgraded everything a few days ago. I don’t care too much if it is offline, so long it is not hackable and that this Plex security breach hasn’t allowed some third party in to corrupt my NAS. Can Plex answer this please?

This Worked for me finally:

For docker I exec’d bash into the plex container and ran the command there

3 Likes

I was able to regain my Synology NAS by using http://192.168.0.19:32400/web/index.html#!/ locally. Of course this would depend on it’s address on your local network. I’m afraid I can’t speak to a remote access address, but hopefully this will help get you on the right track. Good luck!

In a crisis like this you would expect to receive official information as soon as possible. But, well, it is Plex, so we get silence. And a nonsense explanation some days later.

2 Likes

I’ve reset my password twice now, and all my devices are being left logged in except my server itself. I’m able to reclaim it fine, it’s just this doesn’t seem to be logging everything else out like the checkbox is supposed to do.

Not sure if that’s a blessing in disguise or what. :man_shrugging:

image

1 Like

Observation: If Plex worked like Jellyfin, with locally controlled authentication, this breach would have never happened – since there would be no corporate mothership to hack then.

Arguably you can do this both ways. Have the actual server admin and authentication done on the Plex server, and then have the usage info Plex collects be reported under an independent identifier that has no admin capabilities on the server itself. That way if the Plex database gets broken into you can’t really do anything malicious.

6 Likes

That will not work when trying to claim a Synology based server.

Use a incognito/private browser window. Go to http://<syno_ip_address>:32400/web.

You have to use the IP address when claiming. Using a hostname, Synology quickconnect, etc will not work.

Hello @fusengum ,
I also have Plex installed on my Synology, and like many I changed my password following the email received regarding the breach.
By changing my password I asked to disconnect all my connected devices.
And obviously now that I reconnect with my new password via the web interface to my plex server on my Synology NAS, I am no longer authorized to access the Plex server on the Synology…
I stopped and restarted the package on the Synology, but nothing changed…
Do I have to remove PMS from Synology and then reinstall it for it to work again? (And if I do that I will lose my entire film/series library…)

Thanks for your return.
Skelton

1 Like

I cannot use the CURL command as I receive an error 401 Unauthorized. I cannot use the “Claim” function via Plex - General, as I do not see any “Claim” option. Been working on this since receiving the email couple hours ago. Hugely frustrating. restarted several times.

I changed my password, checked the log off all box and relogged in everywhere. No problems.

Thank God I don’t work in IT anymore.

1 Like

This does not work for me… Tried restarting Plex via Package center as well. I still do not see an option to claim my server..

You must have already changed your password for this to work.

Check Authorized Devices. If the server is still present, delete it.

If you are running DSM 7:

Uninstall Plex Media Server with the default “Keep” “Sign out and unclaim this server” option (your libraries, metadata, etc will not be removed).

Reinstall Plex Media Server using the Claim Token option. This will re-claim your server.

Then point a browser at the IP address of the server: http://<syno_ip_address>:32400/web and login. Your server should be in a claimed state.

1 Like

Hi @FordGuy61
I tried to access my Plex server via the web interface and the type url: http://<syno_ip_address>:32400/web, but I have access to an XML file and not to the page of server login… An explanation?
(FYI I redirected port 32400 to another port to protect access a little more and even when I change the port I don’t have access)

Could you help me ?

Thanks a lot/
Skelton

Same here. First it said I had an unclaimed server, then it said I am not authorized to access it. Could anyone please suggest a way forward?

THANK YOU - this worked for me when no other methods did.

You have successfully changed your Plex password and logged into your Plex account with it, correct?

Look in Authorized Devices. If the server is listed, delete it. That will place your server in an unclaimed state.

Then point an incognito window at http://syno_ip_address:32400/web.


If your NAS is running DSM 7, you have another option:

Uninstall Plex Media Server with the default, “Keep settings” Sign Out and Unclaim option.

Re-install Plex Media Server using the “Claim Token” option.

Then point a browser at the IP address & login. The server should be in a claimed state.

2 Likes