Wyze Labs Data Breach Exposed Personal Info for Three Weeks in December

A Wyze Labs data breach left information of 2.4 million customers exposed to the public for most of December.

According to the New York Times, Wyze Labs executives confirmed that from Dec. 4 to Dec. 27, an employee error led to the data breach.

A blog by Twelve Security posted on Dec. 26 made not only the public first aware of the breach, but also Wyze Labs executives as well. Wyze co-founder Dave Crosby told the Times that on Dec. 27, the company found a second data breach during an audit of its security measures.

Wyze Labs sells a wifi-enabled indoor camera that starts at $20. Other similar cameras are known to sell for up to $200. Both the New York Times-owned Wirecutter review site and CNN Business listed the Wyze Labs indoor camera on their lists of top tech gadget gifts for 2019.

According to Crosby, the initial data breach happened when one of Wyze’s employees worked on a database to pull user analytics. The information the employee sought included camera connectivity data and the number of cameras connected by each customer. In the process of this new database’s creation, security protocols were removed, resulting in the exposure of personal information, but not financial information, according to Wyze.

Wyze also said the second data breach did not contain passwords or financial information, either.

Wyze co-founder Dongsheng Song told the New York Times, “We didn’t properly communicate and enforce our security protocols to new employees. We should have built controls, or a more robust tool and process to make sure security protocols are followed.”

According to a post on Wyze Labs’ website from Song regarding the data breach, the exposed information included Wyze nicknames, Wyze device names, user emails, profile photos, Wi Fi router names and in some cases, Alexa integration tokens.

Wyze was founded by three former Amazon employees and is headquartered in Seattle.

Wyze Labs Data Breach Highlights Cloud Vulnerabilities

The Wyze Labs data breach shows the race between cybersecurity and hackers has now entered people’s homes. While most data breaches seem to happen in some invisible, remote cloud, the Wyze breach literally and figuratively hits home with affected consumers.

According to CNN Business, several families reported their Ring in-home cameras by Amazon were hacked in December. At least one 8-year-old child was told by the hacker that he was Santa Claus and tried to convince her to tear up the room. Amazon said the hackers didn’t breach Ring’s security protocols, but probably accessed the home camera systems due to weak passwords or stolen login information.

In recent years, many companies have faced class action lawsuits over data breaches and have paid millions of dollars in judicial decisions and settlements.

The New York Times quoted an email it received from Riana Pfefferkorn, associate director of surveillance and cybersecurity at the Stanford Center for Internet and Society. She advised consumers to seriously consider how much of their personal lives they are willing to risk others knowing by using home monitoring systems that are cloud-based.

“Consumers should be wary of low-priced ʻsmart home’ devices — what you save in money, you might pay for with a breach of your sensitive information,” Pfefferkorn said. “In addition, consumers should think twice about just how ʻsmart’ they need, say, a scale to be anyway.”

Join a Free Wyze Camera Class Action Lawsuit Investigation

If you own a Wyze camera and your camera was active from Dec. 4-26, your information may have been compromised and you may qualify to join this Wyze Labs data breach class action lawsuit investigation.

Learn More

This article is not legal advice. It is presented
for informational purposes only.