An 8-year-old in Mississippi, a Georgia woman lying in bed, a Michigan family watching TV, and dozens of other Ring users were harassed by hackers via their home security cameras — according to a new lawsuit.
Two families whose Ring cameras were allegedly hacked brought the lawsuit against Amazon, which owns the home security company. They are seeking class action status, claiming families across the country who have suffered similar violations should be included in the lawsuit.
The lawsuit, filed in federal court in California, was brought by two couples: Ashley LeMay and Dylan Blakeley; and Todd Craig and Tania Amador.
LeMay and Blakeley claim a hacker accessed the Ring camera they had set up in their daughters’ room. They mounted the camera there so LeMay could keep an eye on her daughters — particularly one prone to seizures — while she worked overnight shifts at a nearby hospital, according to the complaint.
The couple claims the hacker used the camera to shout racial slurs at their 8-year-old daughter, then said, “I’m your best friend. I’m Santa Claus. Don’t you want to be my best friend?”
Craig and Amador claim that a hacker accessed their Ring devices despite their unique passwords that the company confirmed were “very strong.” A hacker used their Ring camera to blare sirens and shout the message, “Ring support! I would like to notify you that your account has been terminated by a hacker!” The intruder went on to say, “Pay this 50 bitcoin ransom or you will get terminated yourself,” according to the complaint.
The plaintiffs accuse Ring of negligence, breach of implied contract, and other violations. They claim Ring failed to implement basic security features like two-factor authentication and notifying users of suspicious log-in attempts.
“This is in stark contrast to the protections used by other internet-based companies, even those not in the business of security,” the complaint says. “For example, social media companies like Twitter, Facebook, and Instagram, email providers like Yahoo! and Gmail, and even streaming services such as Netflix notify accountholders when they detect a suspicious login attempt, or any login attempt, from a new browser, location, or device.”
Ring says the breaches are not the result of hacking into company records. A spokesperson previously told GeekWire, “Ring has not had a data breach.”
“Our security team has investigated these incidents, and we have no evidence of an unauthorized intrusion or compromise of Ring’s systems or network,” the spokesperson added. “It is not uncommon for bad actors to harvest data from other company’s data breaches and create lists like this so that other bad actors can attempt to gain access to other services.”
Ring declined to comment on the lawsuit.
The plaintiffs say Ring should have built its products to protect against intrusions using credentials harvested from other breaches.
“Ring’s excuses fail to recognize that Ring’s own products are not designed in a manner that would prevent such hacks, even though it could have easily implemented security features designed to do just that,” the complaint says.
The plaintiffs are asking the judge to grant the case class action status and award damages and penalties to the affected parties.
Special Coverage: Stay up-to-date on CES 2020 with dispatches from GeekWire
The Mississippi child who was harassed and similar breaches attracted media attention over the past few weeks at a time when Ring was already under the microscope. The company is mired in controversy over its relationship with law enforcement.
Ring CEO Jamie Siminoff told CNET last week that he had a strong personal reaction to footage of the Mississippi breach.
“Seeing that, that video of that girl, made me cry,” he said. “And every time I think about it makes me sad.”
But Siminoff dismissed concerns about police surveillance in an interview with Axios at the massive Consumer Electronics Show in Las Vegas. Civil rights groups and elected officials have criticized Ring for its cozy relationship with police, which can request security footage from customers via the Neighbors app.
“I don’t think any of the concerns I saw were reasonable,” Siminoff told Axios. “What we are doing is a good, beneficial thing.”
On Monday, Ring announced stricter privacy and security measures for its devices. The company unveiled the new features at the start of CES.
Read the complaint below.
Ring Lawsuit by GeekWire on Scribd
