“Roku said it discovered the second incident while it was notifying some 15,000 Roku users that their accounts were compromised in an earlier credential stuffing attack.”
Roku kept payment data on accounts protected by nothing but a password. Attackers reused leaked logins to get into 576,000 of them and spent stored cards on hardware and subscriptions in fewer than 400. Roku rolled out two-factor authentication only after two breaches. A company that knows exactly what you watch never bothered to check who was logging in.