Netflix Account Hacked

[DB44]

I must admit to some injured pride, but the story is probably worth sharing.

On Christmas Day, an email arrived in a webmail account that I keep for some overseas dealings, including my Netflix account. The email advised me that my request to change my email address was being processed. Unfortunately I did not see this until 6 January, and had not used my Netflix account since Christmas Eve. To cut a long story short, my account had been hijacked.

What I believe happened is that the hijacker succeeded in a brute force password attack on my Netflix account. I had stupidly used a password consisting of numbers for ease of entry on different devices. Having gained entry to my Netflix account, the next step was to change the password, followed by setting up new viewing profiles. The Hijacker now had a Netflix account being paid for by me!

When I attempted to login to Netflix I was of course unable, but was able to use the lost password function. I then logged in and found an empty account with no streaming profile or payment details. It later transpired that this action had created a new account under the original email address.

I used the online chat function and was able to work out more or less what had happened. However, the only way to trace the original account was via the credit card number, which they could not, of course, take via chat. However, a quick VOIP call to their US help line in which I identified myself and provided the credit card details concerned had the original email address restored to the account and a new strong password set within about 10 minutes.

I gather that this is not a new problem to Netflix, who dealt with the matter quickly and efficiently. They did not show any interest in investigating the matter, but I don't blame them for this as it would almost certainly prove fruitless.

I am not of course absolutely certain that access to my account was by brute force attack, and there are of course other possibilities. However, given the weak password I used, I do consider this the most likely of them. I also have no idea where the hijacker would have obtained a list of Netflix accounts or indeed whether this may also have been random, though Netflix did reset my password unilaterally in October, notifying me with an email saying "We believe that your Netflix account may have been compromised by a website or a service not associated with Netflix."

The lessons to be learned are:

1. Use a strong password on your Netflix account;
2. Check for emails from Netflix regularly;
3. Remember that Netflix will create a new account if you request a password reset but your account has been hijacked. If you login to find no streaming plan or payment information follow-up with Netflix.