Identity for Media & Streaming

The job identity does in media and streaming

Streaming and media platforms run consumer identity at very large scale across phones, TVs, consoles and browsers. Identity gates subscription entitlements, enforces household and concurrency rules, and protects stored payment methods. Behind the product, publishers and studios run collaboration tools, code repositories and ticketing data that attackers value as much as subscriber accounts.

Media and streaming account for 6 of the 123 incidents in the Identity Breach Database (4.9%). Five of the six were disclosed in 2023-2024 and one in 2025-2026; the Identity Breach Report 2026 notes the 2023-2024 spike is five unrelated incidents rather than one campaign. What links them is credentials: stolen, stuffed, phished or left exposed.

The identity threat picture, from the incident record

Infostealers and stolen credentials. 3 of the 6 trace to credentials harvested by infostealer malware, the infostealer credential harvesting technique. At Disney, an employee installed a trojanized AI art tool on a personal computer; the attacker used the stored credentials to log into the employee's Slack account and downloaded about 1.1 TB from thousands of channels. At Nikkei, malware on an employee's personal computer leaked Slack credentials, exposing data on up to 17,368 employees and partners. Ticketmaster was one of the victims of the Snowflake campaign, where an analytics account with no MFA was opened with a harvested password. Ticketmaster did not disclose a total; the 560 million figure is the seller's unverified claim. The common thread is covered in the infostealer session hijacking teardown.

Credential stuffing against subscribers. Roku lost 15,363 accounts to credential stuffing in a first wave and about 576,000 in a second, found while investigating the first, for 591,363 in total. Attackers used stored payment methods for purchases on fewer than 400 of them. Roku's fix was to turn on two-factor authentication for every account.

Phished staff and exposed tokens. At Reddit, a cloned intranet gateway captured an employee's password and one-time code together in February 2023, the AiTM phishing proxy pattern. At The New York Times, a GitHub credential exposed in January 2024 was used to take internal repositories, and about 273 GB was later posted online. See secrets in repositories and CI.

MFA status. MFA was absent on the abused account in 2 of the 6 (Roku and Ticketmaster), bypassed in 1 (Reddit), not applicable in 1 (the exposed token) and unknown in 2. The failed control was authentication in 3 and credential storage in the other 3.

The regulatory floor

• GDPR and CCPA/CPRA govern subscriber data, and ad-supported tiers make consent management part of identity. CCPA's first cybersecurity audit reports, which assess MFA and access controls, are due 1 April 2028 for businesses over $100 million in revenue.
• COPPA applies wherever children under 13 use the service. The amended Rule, with a compliance date of 22 April 2026, updated verifiable parental consent methods, added biometric identifiers to personal information and requires a written security program. See age verification.
• Australia's Children's Online Privacy Code must be registered by December 2026 under the Privacy Act 1988, and India's DPDP Act core obligations, including verifiable consent for children, apply from May 2027.
• Japan's APPI governs Japanese publishers such as Nikkei and requires reporting personal data leaks to the PPC, and notifying the people affected, where required.

The identity controls that matter most

1. MFA or passkeys on every subscriber account with a payment method. Roku's own remediation is the evidence. Passkeys remove the reusable password and suit phones well. See passwordless authentication implementation.
2. Bot and breached-password defenses at login. Rate limiting, bot signals and breached-credential checks catch stuffing waves before they reach hundreds of thousands of accounts.
3. The device authorization grant for TVs and consoles. The device code flow in OAuth 2.0 moves sign-in to a phone where passkeys work, instead of typing passwords with a remote. Pair it with short code lifetimes, because device code phishing abuses the same flow.
4. Managed-device-only access to corporate SaaS. Disney and Nikkei both accepted credentials from personal computers. Conditional access requiring a managed, compliant device, plus phishing-resistant MFA, makes harvested credentials insufficient.
5. Secret scanning with immediate revocation. The Times token was exposed for months before use. Fine-grained, short-lived tokens and automated secrets rotation close that window.
6. Entitlements tied to identity, not to the device. Access should end when the subscription ends, and household rules should be enforced server side.

Vendor categories and named vendors

• Consumer CIAM at scale: Auth0 and Stytch for developer-led teams, Amazon Cognito for AWS-native scale. See best CIAM for high scale.
• Breached and infostealer credential intelligence: SpyCloud for screening subscriber and employee credentials against malware logs.
• Workforce access: Okta or Microsoft Entra ID for device-aware conditional access to collaboration tools, with Yubico keys for phishing-resistant login. See best phishing-resistant MFA.
• Browser-level detection: Push Security for phishing and session theft at the employee browser.
• Secrets: GitGuardian for detecting exposed tokens in code; see best secrets management tools.
• Fraud signals: the identity verification category for device and behavioral risk at login.

Background on requirements is in identity for media and streaming.

Common pitfalls

• Treating account sharing as only a revenue problem and missing the takeover it hides.
• Leaving 2FA optional until a stuffing wave forces it on.
• Letting staff reach Slack and other SaaS from unmanaged personal devices.
• Painful authentication on TVs that drives support load and pushes users to weak passwords.

Where it is heading

Passkeys and the device authorization grant will make the living-room login both easier and harder to steal. On the workforce side, the Disney and Nikkei cases are pushing media companies toward managed-device requirements for collaboration tools.

Frequently asked questions

What causes most identity breaches at media companies?

Credentials. In the database, 3 of the 6 media and streaming incidents trace to infostealer-harvested credentials, and the rest to credential stuffing, a phished employee and an exposed code token.

How should streaming services handle sign-in on TVs?

Use the OAuth 2.0 device authorization grant so the user signs in on a phone or computer, where passkeys and MFA work, with short-lived codes to limit device code phishing.

Would MFA have stopped the Roku attacks?

Roku's own remediation was to turn on two-factor authentication for every account after the two stuffing waves, which together reached 591,363 accounts.