Dozens of people who say they were subjected to death threats, racial slurs, and blackmail after their in-home Ring smart cameras were hacked are suing the company over “horrific” invasions of privacy.
A new class action lawsuit alleges that lax security measures at Ring, which is owned by Amazon, allowed hackers to take over their devices. Ring provides home security in the form of smart cameras that are often installed on doorbells or inside people’s comes.
The suit against Ring combines complaints filed by more than 30 people in 15 families who say their devices were hacked and used to harass them. In response to these attacks, Ring “blamed the victims, and offered inadequate responses and spurious explanations”, the suit alleges. The plaintiffs also claim the company has also failed to adequately update its security measures in the aftermath of such hacks.
People who could benefit from the lawsuit include the families named in the case, as well as any other Ring users who have been hacked. The class also covers the tens of thousands of customers who purchased a Ring doorbell between 2015 and 2019, even if they were not hacked.
“I would imagine that there are a whole lot more people out there who have been hacked,” said Hassan Zavareei, the lead attorney on the case. “This is probably just the tip of the iceberg.”
The suit outlines examples of hackers taking over Ring cameras, screaming obscenities, demanding ransoms, and threatening murder and sexual assault.
One Ring user says he was asked through his camera as he watched TV one night, “What are you watching?” Another alleges his children were addressed by an unknown hacker through the device, who commented on their basketball play and encouraged them to approach the camera.
In one case, an older woman at an assisted living facility was allegedly told “tonight you die” and sexually harassed through the camera. Due to the distress caused by the hack she ultimately had to move back in with her family, feeling unsafe in the facility where she once lived.
In another incident, a plaintiff who had purchased a Ring device to keep an eye on her four-year-old daughter with a history of seizures alleges that music from a horror film was played through her camera. Her complaint reads:
On December 4, 2019, shortly after 8 pm, while Ms LeMay was running errands, both of the Ring devices began live-streaming. Simultaneously, the Tiny Tim cover of “Tiptoe Through the Tulips”, a song that appeared in a scene from the 2020 horror film “Insidious”, began to play through the two-way talk feature. Intrigued by the music, Ms LeMay’s eight-year-old daughter, AL, went to the room she shares with two of her younger sisters to investigate. But the room was empty. As AL wandered the room, looking for the source of the music, the song abruptly stopped, and a man’s voice rang out: “Hello there.”
LeMay immediately changed passwords and called Ring that day to report the hack, but she didn’t get a response for nearly a week. The company never told LeMay where the hack originated or how it occurred, the complaint alleges. The plaintiff eventually had to leave her job because of the emotional distress, the complaint said.
Ring has not said who is behind the hacks, and victims say they still do not know who accessed their homes through the devices.
Repeatedly, Ring blamed victims for not using sufficiently strong passwords, the suit claims. It says Ring should have required users to establish complicated passwords when setting up the devices and implement two-factor authentication, which adds a second layer of security using a second form of identification, such as a phone number.
However, as the lawsuit alleges, Ring was hacked in 2019 – meaning the stolen credentials from that breach may have been used to get into users’ cameras. That means the hacks that Ring has allegedly blamed on customers may have been caused by Ring itself. A spokesperson said the company did not comment on ongoing litigation.
The lawsuit also cites research from the Electronic Frontier Foundation and others that Ring violates user privacy by using a number of third-party trackers on its app.
The suit said that, at present, Ring “has not sufficiently improved its security practices or responded adequately to the ongoing threats its products pose to its customers”. Security and privacy experts have also criticized Ring’s response.
“After a slew of terrifying headlines about their poor security practices, Ring has finally made some improvements,” said Evan Greer, the deputy director of the privacy advocacy group Fight for the Future. “But implementing basic security that they should have had in the first place does nothing to change the fact that Ring cameras make communities less safe, not more safe.”
In addition to hacking concerns, Ring has faced increasing criticism for its growing surveillance partnership with police forces. Ring has now created law enforcement partnerships, which allow users to send footage and photos to police, in more than 1,300 cities.
“Ring’s surveillance-based business model is fundamentally incompatible with civil rights and democracy,” Greer said. “These devices, and the thinking behind them, should be melted down and never spoken of again.”