Relevant if using Google login? Important notice of a potential data breach 24th of August 2022

[OttoKerner]

It is still recommened to log out all devices (including the server[s]) and clients and log them back in, to invalidate all existing access tokens.

Do we know if the 2-Factor secrets were stolen along with the passwords?

Correct. This was not communicated at the time I made this response. To be absolutely on the safe side and to prevent the misuse of leaked device access tokens, users are advised to reset these manually. (I am recommending the manual procedure, because if you go through the “Password reset” procedure, you will end up with a regular password on your Plex account, which you didn’t have before [if you created your Plex account using one of the federated auth providers].) https://app.plex.tv/desk…

You both have indeed no regular password on your Plex accounts. I recommend you to not perform the “Password reset” procedure, because at the end of that your Plex account will have a password.