Ring LLC, $5,800,000
Ring let employees and contractors access customer video footage and failed to implement basic security controls, allowing attackers to hijack thousands of customer cameras.
Case identifiers
- Respondent
- Ring LLC (and Amazon.com, Inc.)
- Agency
- Federal Trade Commission
- Announced
- 2023-05-31
- Monetary relief
- $5,800,000
- Case number
- FTC File No. 192-3153
- Statutes cited
- FTC Act § 5
Key facts
- 1
Every Ring employee and hundreds of third-party contractors could access every customer’s video feed.
- 2
One employee viewed thousands of recordings of at least 81 female users in their bedrooms and bathrooms for months.
- 3
Weak authentication and no credential-stuffing protections allowed attackers to access 55,000+ customer accounts.
- 4
$5.8 million consumer refund fund plus implementation of a comprehensive privacy and data-security program.
What the order requires
Injunctive terms imposed by the Federal Trade Commission. These bind Ring LLC's data practices going forward.
- Deletion of all customer videos, face data, and derived data collected prior to 2018.
- Prohibition on using biometric information collected without consent for machine-learning.
- Required multi-factor authentication and biennial external assessments.
Primary sources
Read the original government documents. These are the authoritative records, everything on this page is derived from them.
Generate requests in under 60 seconds
Generate a deletion request for $9
Where this action sits in the tracker
- It is one of 19 FTC actions among the 26 cases in this tracker.
- Of the 19 tracked actions with monetary relief, $5,800,000 ranks number 10 by amount.
- 6 tracked actions were announced in 2023.
- It is one of 7 tracked deceptive-advertising actions.
- It is one of 7 tracked breach actions.
FAQ
What did the FTC charge Ring LLC with?+
Ring let employees and contractors access customer video footage and failed to implement basic security controls, allowing attackers to hijack thousands of customer cameras. The Federal Trade Commission cited FTC Act § 5.
How much did Ring LLC pay?+
Ring LLC had monetary relief of $5,800,000, announced on 2023-05-31. The settlement also imposed injunctive terms (see below).
Does the Ring LLC settlement mean my data has been deleted?+
The order requires Ring LLC to delete certain categories of consumer data (see injunctive terms). Individual consumers should still exercise state-law deletion rights (CCPA, CPA, TDPSA) to confirm deletion from any remaining successor databases.
How can I read the original FTC order?+
The Federal Trade Commission press release is available at https://www.ftc.gov/news-events/news/press-releases/2023/05/ftc-says-ring-employees-illegally-surveilled-customers-failed-stop-hackers-taking-control-users. The case / matter number is FTC File No. 192-3153.