Passwords from old Pluto TV accounts leak online

A hacking group shared more than 3 million usernames, hashed passwords and other account details in a forum.
(Image: ViacomCBS/Handout)

A hacking collective has posted more than 3 million usernames, hashed passwords and other account details they claim is connected to a legacy version of free streaming TV service Pluto TV.

The information relates to an outdated version of Pluto TV that allowed users to sync a list of favorite channel streams between different its TV, smartphone and desktop apps.

That version pre-dates Pluto TV’s eventual acquisition by ViacomCBS for $340 million. That deal closed in early 2019. The oldest account information in the list is from October 2018, according to security researchers who have examined it.

Though the list contains passwords, they are encoded using a method known as hashing, which makes them difficult — if not impossible — to crack.

A Pluto TV spokesperson did not return a request for comment as of Monday evening. But at least one source with knowledge of the situation said the company is investigating it as a legitimate compromise of user information.

Pluto TV’s current service, which offers more than 200 streams of free content, does not offer a feature for users to create accounts. The service had more than 36 million monthly active users as of late October.

Thanks for reading and supporting The Desk. If you have a question, comment or news tip, send a message by email or text, or connect on Facebook, Twitter or LinkedIn.

Also, check out our new membership service The Desk: Pro Access for exclusive reporting, news scoops and in-depth analysis.