Netflix “Aggressively Taking Action” Against Leaks As Source Is Revealed

This week has seen one of the biggest leaks in Netflix’s history and potentially in Hollywood’s history, with over a dozen major upcoming 2024 and 2025 titles leaked from both Netflix’s upcoming slate and a slew of other distributors and streamers. 

Note: As with all our previous reports, we won’t be divulging any leaked assets or information on how to find said leaks. We actively discourage anyone from looking for these files and would 

Here’s a quick recap of the timeline. On Wednesday, leaks began appearing on 4Chan, and files were shared across social media throughout the day. 

On Thursday, the number of titles that had been leaked continued to grow, with Spellbound, Terminator Zero, Plankton: The Movie, Jentry Chau vs. The Underworld, Ranma 1/2, Dan Da Dan, and Fairly Odd Parents: A New Wish! among the Netflix titles to get leaked, with other distributor titles also getting released. 

Leaks continued throughout the day with more Netflix titles being made available, including Arcane season 2 and, later in the evening, the first batch of episodes of Heartstopper (season 3). The latter show was the first live-action title to be leaked, and some had speculated that Stranger Things would be among the next to leak. 

This morning, Netflix officially acknowledged the leaks. 

“One of our post-production partners has been compromised, and footage from several of our titles has unfortunately leaked online,” Netflix said in a statement to us, continuing, “Our team is aggressively taking action to have it taken down.”

This does appear to be the case with many of the video files shared online now, resulting in either a 404 error (meaning they’ve been taken offline) or a 451 error, which means “Unavailable for Legal Reasons.” One such file now lists that following a DMCA complaint from Riot Games. 

You may recall that this isn’t the first major Netflix leak of this sort. In fact, leaks occurred at the beginning of the year with Fairly Odd Parents!: A New Wish! (which is how we learned Netflix would distribute the show in some regions). Around that time, Saving Bikini Bottom: The Sandy Cheeks Movie was also leaked in full. Identifying information was unavailable on those leaked but were in similar file formats. 

So, where did these particular leaks come from? According to archived 4Chan threads seen by What’s on Netflix and security firm MomentPort (who had a client directly impacted), the leaks stemmed from IYUNO, which confirmed a breach (see below). 

With locations worldwide, IYUNO describes itself as a “global entertainment technology and localization company” that works with Netflix on dubbing and subtitles. Their homepage displays two badges from Netflix stating they’re a “Preferred Fulfillment Partner” and in the Netflix Post Partner Program. They also list that they work with Warner Bros. Discovery, Paramount, NBCUniversal, and RIOT Games, among others. 

MomentPort details the hack following one of their internal tools designed for a partner in the film industry, alerting them that files had been found online. Upon investigation, the firm details how the hack happened with external bad actors able to access IYUNO’s internal web application where files were stored, including all the Netflix shows and movies that were leaked. 

While some files had scrubbed any identifying information, others identified that the file was from IYUNO. 

Per the blog post from MomentPort, a 4Chan user “claimed that the breach originated from an API used during the registration process of the internal web application, which was deployed in an insecure manner. This vulnerability allegedly allowed any public email address to register an account and access IYUNO’s internal content management system, which hosts a plethora of unreleased and released media.”

The firm also notes that “all the posted files appear to have been encoded in the same distinct way—a resolution of 640 by 360, encoded using FFmpeg, a common choice for server-side encoding.”

I asked the CTO of MomentPort a couple of questions regarding the breach including how much of a blunder this is. In response, Travis Doering told me, “In the world of film, this is as bad as it gets. This is the equivalent of a bank allowing your safety deposit box to be accessed by a thief. IYUNO was entrusted with multiple workprints, which are the most valuable assets in the production pipeline, sometimes a year in advance, and now that trust has been broken.”

IYUNO released a statement on the matter on August 9th, saying:

“Iyuno is aware of a recent security issue, involving unauthorized access to confidential content. Protecting our clients’ confidentiality and ensuring the security of their content is our highest priority. We are actively investigating this security breach to mitigate any potential risks and identify the responsible parties. When there are material changes or information we will make further statements.”

---

The true extent of the leaks has yet to be determined, and it is unclear whether more shows from Netflix or other distributors will soon be leaked online.  

We’ll keep this post updated with any further developments.