According to numerous reports, a number of hacked Disney+ accounts have been popping up over the web lately. And those breaking into your account aren’t taking advantage of some crazy vulnerability in the streaming service. They’re either phishing your account data or, worse, logging in as you by using credentials that have already been exposed in another password breach elsewhere.
In other words, if you’re using the same password for Disney+ that you use for other services, and one of those is hacked, you’ve just put your entire Disney account in jeopardy—Disney parks, streaming services, and all.
Tweet may have been deleted
Tweet may have been deleted
It’s a bit strange that Disney has allowed its fans to link all of their services together like this, although it makes sense from a technical standpoint. It’s not like you have a separate password for Google Play, Google Drive, and your Gmail, after all. What doesn’t make any sense at all is why Disney has no means for letting a person add extra security to their accounts via two-factor authentication.
At least, if I’m planning a trip, making purchases, and watching movies online, I’d like to be able to prevent unauthorized access to my single and only account by forcing would-be attackers to enter a special code that requires physical access to my phone to obtain. That’s hardly Mickey Mouse-level magic; it’s just good account security.
In the meantime, if you’ve already signed up for Disney+, I recommend changing your password to something you don’t use anywhere else and using one of the many amazing password managers available today to keep track of that (and all the other unique passwords you use). That way, it should be pretty difficult for another person to learn of your password unless they sucker you into typing into a website or service that is not actually Disney+.
You should also be able to sign up for Disney+ using a variant of your real email address, like [email protected]), which will keep it from being tied to your other Disney services, but this measure seems a bit extreme. You never know what Disney might unveil at some future point that could give you some kind of benefit for tying all of your Disney services under a single account. (I’m just speculating.)
Give yourself a unique password, hope Disney gets its act together regarding two-factor authentication, and that should be all you need to do to to stay safe with Disney+ (for now).