←back to thread

Plex Security Incident

(links.plex.tv)
104 points andyexeter | 1 comments | | HN request time: 0s | source
Show context
imglorp ◴[] No.45175285[source]
> An unauthorized third party accessed a limited subset of customer data from one of our databases

How could only a subset be affected? Any architecture other than a "users" db table wouldn't make sense.

replies(5): >>45175314 #>>45175328 #>>45175329 #>>45175330 #>>45175400 #
1. nimih ◴[] No.45175400[source]
I have no idea how Plex runs their servers, but I've worked at companies where new systems are rolled out for new users/accounts, but old users/accounts are left on the "legacy" system (usually with the plan to migrate once the new system has been deployed and there is bandwidth available to handle the complexity of migrating users between systems). In particular, if you have a long-running service where some very old accounts might have special billing/pricing logic that you want to continue honoring but is difficult to implement in the new system, such a setup might make sense to continue long-term for a small subset of accounts.

Alternatively, maybe they mean that the limited subset of data was specifically the "email" and "password_hash" columns of the database ;P