Disney+ account hacked? Here’s what to do
Move fast and in the right order: reclaim the account through Disney+’s official flow, kick the attacker out of every session, then close the door they came through — usually a password that leaked in a breach and was reused.
If your Disney+ account was hacked: start recovery at the official page (help.disneyplus.com), change the password to a unique one, sign out all other sessions, and re-check the recovery email and phone on the account. Then find out how the attacker got in — check whether your password appears in known breach data — and turn on two-factor authentication so it can’t happen again.
Recover your Disney+ account, step by step
These steps follow Disney+’s official process. Official links only: account recovery.
Reset the MyDisney password and log out all devices from account settings.
Remove unfamiliar profiles and review the email/phone on file.
Check billing across Disney properties (bundle upgrades, shopDisney orders).
Enable available login protections and use a unique password - Disney logins are heavily stuffed.
What trips people up with Disney+
- One Disney login (MyDisney) covers Disney+, Hulu bundle, parks and shopDisney - a takeover here can touch park reservations and merchandise orders, not just streaming.
- Credential-stuffed Disney+ logins resell in bulk; strange profiles plus a changed email is the standard pattern - use the help center's compromised-account path, not just reset.
Still logged in? Lock the account down now
If you can still get in, you're racing the attacker. In this order: change the password to a long, unique one; sign out all other sessions/devices (the setting exists in Disney+'s security settings); confirm the recovery email and phone number are yours (attackers quietly add their own so they can "recover" the account later); remove unfamiliar linked apps or API access; and turn on two-factor authentication. Only then deal with anything the attacker posted, sent or bought.
Locked out of Disney+ — email or phone was changed
This is the worst-case scenario and the most common complaint: the attacker changed the account email, phone number or password so the normal reset flow emails them, not you. Do NOT keep triggering password resets — they go to the hacker. Go straight to Disney+'s dedicated recovery flow (link above), which is built for exactly this case: it verifies you by your original signup details, previous passwords, linked devices or a government ID / selfie check, bypassing the stolen email. Watch for the security notice Disney+ sent to your OLD email when the address was changed — it usually contains a "revert this change" link that works for a limited time and is the fastest way back in.
Got a "new login" alert from Disney+?
Treat it as real but verify it the safe way: never tap the link in the message itself (fake login alerts are a top phishing template for Disney+). Open the app or type the address yourself, check the active-sessions list in security settings, and if you see a device or location you don't recognize, sign it out and change your password immediately. If the alert was genuine, that password is burned — assume it's circulating and change it everywhere else you reused it.
The attacker spent, moved or stole orders, gift-card balance or loyalty rewards
Document everything first (screenshots of orders, trades or transfers, with dates), then report it through Disney+'s official support flow — platforms restore fraudulent purchases and stolen orders, gift-card balance or loyalty rewards case-by-case, and a clean, dated report is what gets approved. If a card or bank account was charged, dispute the charges with the issuer as unauthorized. Change the password on the email account attached to Disney+ too — if the attacker owns your inbox, they'll just take the account back.
Why this happened — and how to make sure it can’t again
About a third of account takeovers are credential stuffing: a password you used on Disney+ (or the email behind it) leaked in some other company’s breach, and attackers replayed it here automatically. The FBI’s IC3 logged over 5,100 account-takeover complaints with $262M in losses in 2025 alone (IC3). Even when Disney+ itself was never breached, your reused password from another site opens it.
So after recovery, check what’s already out there: our free scanner shows which known breaches and dark-web dumps include your email — and whether passwords were exposed with it.
Check my exposure — free →After you recover: three doors to close
- Unique password + 2FA. A password manager plus app-based two-factor stops both stuffing and phishing replays.
- Reset everywhere you reused that password — email first (it’s the master key), then bank, then the rest.
- Shrink your public footprint. Attackers research targets on data-broker sites (your address, phone, relatives — enough to social-engineer support lines). Our free opt-out guide covers 190 of them, step by step.
Hacked Disney+ account, answered
How did my Disney+ account get hacked?
The most common cause isn't a hack of Disney+ itself — it's credential stuffing: a password you used on Disney+ leaked from some other site's breach, and attackers tried it here automatically. Roughly a third of account takeovers happen this way, with phishing (fake Disney+ login pages and alerts) close behind. That's why the first fix is a unique password, not just a new one.
Can I get my Disney+ account back?
Usually yes. Use the official recovery flow (https://help.disneyplus.com) — it can verify you even when the attacker changed the email and password. Be patient and respond quickly to follow-ups so the case stays open.
Should I just make a new Disney+ account instead?
Not until you've tried recovery. The old account keeps your history and contacts — and while the attacker controls it, it will be used to scam people who trust you. Recover it, or at minimum report it as compromised so Disney+ can lock it, before you start over.
The hacker placed orders or drained gift cards on my Disney+ account — now what?
Report the orders as unauthorized through Disney+'s support, dispute any card charges with your bank, and check saved addresses and payment methods for ones the attacker added. Loyalty points and gift-card balances are a favorite target because people don't watch them like a bank account — screenshot balances and include them in the report.
How do I stop my Disney+ account being hacked again?
Three things close most of the doors: a unique password (a manager makes this painless), app-based two-factor authentication, and shrinking your exposed footprint — checking your email against known breach databases and removing your personal data from data-broker sites that attackers use to research targets.