I call BS on this. I just received the email that state:

> There is no indication that Roku’s systems have been compromised or that the login credentials used in the attack were obtained from Roku.

I use a PW manager, they didn't get these credentials from another source.