A Portland, Oregon, federal grand jury has charged a man for a scheme to steal and resell customer account details for streaming services including Netflix, Spotify Premium, and HBO Max.
The indictment names Samuel Joyner and an accomplice, Evan McMahon of Sydney, Australia. It alleges that they operated an online service called “AccountBot,” through which users could pay a low fee to access stolen streaming service accounts.
The allegations are a particularly bold example of a hacking risk that costs streaming services billions each year.
AccountBot Sold Accounts as Low as $1.79
The indictment states that the AccountBot site claimed to have access to over 217,000 unique customer account credentials and to have served over 52,000 customers.
“AccountBot customers paid between $1.79 and $24.99 for access to the stolen credentials, depending on how long and which service they wanted to access,” reports The Verge.
The charges are “conspiracy to commit computer and access device fraud,” and come with a maximum sentence of five years in federal prison.
The indictment also holds that the men stolen the passwords through credential stuffing attacks, a term for large-scale automated login requests. With this process, a hacker takes login information from previous data breaches and feeds each username and password combination into various streaming services until they find the combinations that work.
Password Theft Is Huge
These recent charges are far from the first sign that bad actors online are stealing and reselling passwords to paid services.
In some cases, Facebook, Instagram, or Twitter accounts are stolen, cutting off the original owner entirely in order to deliver the account to a new owner who wants a built-in audience or a particularly unique username. But when it comes to Netflix and Spotify, you'll retain your account — you'll just have someone else poking around in it.
In this new charge, no details were given on how much total revenue the alleged streaming password reselling scheme was bringing in, though it's hard to imagine the monetary benefits were a high as, say, the millions that ransomware attackers can potentially make. Still, stealing an entire inventory would be one way to keep the overhead costs low.
Are Your Passwords at Risk?
One common phishing technique for swiping Netflix passwords involves building a fake sign-in page or a spoofed account creation page that look just like the real thing but only exist to scoop up your password or payment information.
The solution is a good password manager: Many of the top password keepers will autoload your password, but only on the real website, and may even flag spoofed log-in pages. We've rounded up the best options over here.
The other big issue is an unsecured connection, like in a hotel or an Airbnb rental. Paying a few bucks a month for a great VPN can help with this, and we have the top VPN solutions ready to go as well. Get a solid password manager and VPN, and you'll be fairly safe from the password reselling schemes of the world.
There is still one big downside here, though: Netflix is sure to eventually cite stolen accounts as the reason why they'll crack down on account-sharing down the road. Shout out to my old college roommate Joel for letting me use his Netflix password for the last seven years.
Here's a quick look at your password manager options:
Our scoring is based on independent tests and assessments of features, ease of use and value.
Local Storage Option
Password Generator Function
A password manager can create secure, complex passwords for you. You won't need to remember them yourself.
Live Chat Support
Cost per year
Overall cost per year for a single user.
Click to Try
BEST ON TEST
Tech.co is reader-supported. If you make a purchase through the links on our site, we may earn a commission from the retailers of the products we have reviewed. This helps Tech.co to provide free advice and reviews for our readers. It has no additional cost to you, and never affects the editorial independence of our reviews. Click to return to top of page