7 million streaming passwords leak onto dark-web markets – more than five million belong to Netflix

A trove of at least 7 035 236 stolen usernames and passwords for the world’s biggest streaming platforms is circulating on cyber-criminal forums, according to a new investigation by Kaspersky’s Digital Footprint Intelligence team. Netflix accounts make up the lion’s share — 5 632 694 compromised log-ins, or roughly four out of every five records exposed.

Unlike headline-grabbing breaches that hit individual companies, the streaming giants themselves were not hacked. Instead, criminals harvested credentials en masse with “infostealer” malware bundled into unofficial browser extensions, pirated apps and other dubious downloads that silently exfiltrate anything a victim types or stores in their browser. “Protecting your streaming account today means thinking beyond passwords — it means securing your devices, avoiding suspicious downloads and being mindful of where your clicks lead you,” warned Polina Tretyak, a digital-footprint analyst at Kaspersky.

While Netflix dominates the haul, other services were also hit:

Fresh phishing wave targets Netflix users in 23 countries

The credential spill coincides with an aggressive SMS-phishing (“smishing”) campaign uncovered late last year. Attackers posing as Netflix customer-service reps text subscribers in 23 countries, claiming a payment problem and urging them to “fix” it via a link to a fake login portal that hoovers up credentials and card details.

How to keep your account safe

• Stick to official stores. Download streaming apps only from Apple’s App Store, Google Play or the platform’s own site.

• Scan before you click. Security suites can block infostealers hidden in “free” movie downloaders or browser add-ons.

• Use strong, unique passwords. A password manager beats recycling the same login across multiple sites.

• Beware urgent texts or emails. Netflix says it never asks for payment details over SMS or email; suspicious messages should be forwarded to [email protected] and then deleted.

• Enable two-factor authentication wherever possible. Most rival platforms now support it, even if Netflix has yet to roll out the feature.

Kaspersky recommends anyone who discovers their credentials for sale to change the password immediately, log out of all devices, run a full malware scan and monitor the linked payment card for fraud.

Netflix, Disney, Amazon, Apple and Warner Bros. Discovery (Max) had not issued public statements at the time of publication, but their support pages echo the advice above: never share passwords, avoid third-party apps and report suspicious activity promptly.

Photo Credit: DepositPhotos.com