Hacker News Reader

Comment by imglorp | Hacker News Reader

> An unauthorized third party accessed a limited subset of customer data from one of our databases

How could only a subset be affected? Any architecture other than a "users" db table wouldn't make sense.

I have no idea how Plex runs their servers, but I've worked at companies where new systems are rolled out for new users/accounts, but old users/accounts are left on the "legacy" system (usually with the plan to migrate once the new system has been deployed and there is bandwidth available to handle the complexity of migrating users between systems). In particular, if you have a long-running service where some very old accounts might have special billing/pricing logic that you want to continue honoring but is difficult to implement in the new system, such a setup might make sense to continue long-term for a small subset of accounts.

Alternatively, maybe they mean that the limited subset of data was specifically the "email" and "password_hash" columns of the database ;P

Could be technically true in that they didn’t access every last bit of “user data” like support chat logs or whatever stored elsewhere, but they have phrased it that way to make it seem like less of a big deal. Just a guess.

Sharding the data across DB's, separate credentials for each DB.

It's easy to imagine Plex has some db sharding going on at their scale, or that they host in multiple geographic regions for regional compliance, or on multiple cloud providers.

Rows 1-200,000 instead of 1-1,000,000 I would presume.

Reply on news.ycombinator.com