Amazon Hit By Potential Class-Action Lawsuit Over Ring Security Issues

Amazon is facing a proposed class-action lawsuit over its Ring smart doorbell security units filed by an Alabama homeowner who said the company has failed to adequately protect the devices against cyber-attacks.

In the action filed last week, John Baker Orange said a hacker recently accessed his Ring unit and frightened his children, aged 7, 9 and 10, by speaking to them through the Ring’s speaker.

Orange cited other recent security incidents involving Ring devices, including a highly publicised event in December in which a remote intruder harassed a Mississippi girl.

He said that when he reported the incident to Ring he was told there was no evidence the company’s infrastructure had been hacked.

Third-party compromise

Instead, the company said hackers may have compromised security credentials at a third-party service that had been reused for the Ring account, according to Orange.

Orange said he paid $249 for the Ring security camera in July, that the devices operate only when connected to the internet and are “fatally flawed” due to the lack of sufficient security, in spite of promising “smart security here, there and everywhere”.

The lawsuit accuses Santa Monica, California-based Ring and parent company Amazon of breach of contract, invasion of privacy, negligence, unjust enrichment and violating California’s Unfair Competition Law through misleading representations of security.

If it achieves class action status it would ask Amazon and Ring to compensate victims and implement “improved security procedures and measures” for new and existing Ring devices.

Security exploit

John Yanchunis, a lawyer for Orange, told Reuters the Ring devices were intended to protect a home’s occupants but had “become a platform for potentially endangering those occupants”.

“So many devices are tethered to the internet, and consumers simply don’t have a realisation of how that can be so easily exploited,” Yanchunis said.

Orange, of Jefferson County, Alabama, said he changed his “medium-strong” password and turned on two-factor authentication after the incident involving his children.

Ring makes smart doorbells that contain a security camera and allow a home’s occupants to monitor and communicate with visitors through a phone app even when not on the premises.

Amazon bought Ring for $839 million (£641m) in cash in April 2018.

Ring said the company does not comment on legal matters.