The worst case scenario, Feingold also said, would be if the hacker was able to reserve the hashes on forum passwords and then sign into using that info. Plex co-founder and CTO Elan Feingold responded, noting that the forums machine was “definitely compromised, likely via PHP/IPB vulnerability,” but Plex had “no reason to believe that any other parts of our infrastructure was compromised.” In addition, he noted that the forums run on a separate machine than the cluster.

The hack itself took place on July 1st, and the hacker claiming to be responsible took to the forums, saying they had “ obtained all of your data, customers as well as software and files.” The hacker also demanded a ransom, payable in the form of Bitcoin, or else the data would be released by way of “multiple torrent networks,” this person said. As a precaution, Plex is blocking those users from accessing their accounts until they complete a password reset. That being said, many Plex users had forum accounts which are linked to their account, which means that both accounts have been compromised as a result of the attack. However, the attackers were only able to compromise the servers hosting the company’s forums and blog – not account information or users’ financial data, the latter which Plex says is not stored on its own servers at all. Plex, a popular application that lets users organize and stream their media collections across devices, has been hacked.

Plex forum