Some Netflix customers who canceled their subscriptions were surprised to see new charges from the video-streaming service on their bank statements months later.
Those peoples’ accounts were reactivated by hackers without their knowledge, according to a new BBC report. The hackers didn’t need users’ bank information to reactivate their accounts – all they had to do was log in.
That’s because Netflix stores customer data for 10 months after someone cancels their subscription, according to the BBC, making it easier for people to rejoin after cancelling.
Some affected users have taken to Twitter to complain about the oversight.
A Netflix spokesperson did not immediately respond to Business Insider’s request for comment. Netflix told BBC that it values customers’ security and users should report suspicious activity on their account to the company directly.
There’s a cottage industry for hacked Netflix accounts. Hackers frequently sell login credentials online at discounted prices – a listing for a four-screen Netflix login is currently live on eBay.