I wrote a post about password security in the past that is relevant to this: Monzo Plus Roadmap for 2019 đź“…
There’s a big market online for stolen media streaming accounts, Netflix and Spotify users are the biggest victims of this. The typical situation is this:
- You use a password for Netflix that you also use on another service
- The other service is compromised
- All passwords and email addresses are leaked from the compromised service
- Malicious people check every leaked password and email combination on Netflix (and other services)
- When a password and email combination are found to work on a service, the account details are noted down as valid
- The valid account details are now sold, often for ~$1, typically with the advice “don’t change any settings so that you can keep using the account indefinitely”. The goal isn’t to steal your account from you, it’s to have cheap access to these services, changing your password will resolve the issue – also change your password anywhere else that same password is used.
The protection against this attack is: do not use the same password on multiple websites. There’s also a small chance this came about from phishing, but very unlikely.