Disney+ accounts sold within days of launch

Disney+ launched a week ago. Within days, accounts were being sold on hacking forums for a few dollars each. Disney says its systems weren’t breached. The most likely explanation is credential stuffing: attackers trying email and password pairs leaked from other sites.

Some victims said they used unique passwords, so malware on their devices may explain a few cases. But most of these takeovers follow the same pattern.

For users:

• Use a unique password for every streaming service. A password manager makes it easy.
• If your account was taken, reset the password and check the email address on the account.

For companies launching a service:

• Expect credential stuffing on day one. Rate-limit logins and check passwords against breached lists.
• Offer two-factor authentication from the start, and alert users when the email or password changes.