I received an email this morning from haveibeenpwned.com that told me:
"You signed up for notifications when your account was pwned in a data breach and your email address has just appeared in a “paste”.
A paste is information that has been published to a publicly facing website designed to share content, usually anonymously. Often a dump of email addresses in a paste is an early indicator of a data breach"
So I checked the paste, and got a CSV titled “Plex.tv.csv” that contains my plex pass user name, email address, IP of the Plex server at the time of release (here July it appears) and a salted copy of my password.
I immediately changed my account password, and I would strongly encourage others to do so.
I would also checked the authorized devices and I hope two factor happens soon.
