throbber
Case 2:19-cv-10899 Document 1 Filed 12/26/19 Page 1 of 30 Page ID #:1
`
`
`
`LAW OFFICE OF
`FRANCIS J. FLYNN, JR.
`Francis J. “Casey” Flynn, Jr., SBN
`304712
`422 S. Curson Avenue
`Los Angeles, California 90036
`Tele: 314-662-2836
`Email: casey@lawofficeflynn.com
`
`MORGAN & MORGAN
`COMPLEX LITIGATION GROUP
`John A. Yanchunis*
`201 N. Franklin Street, 7th Floor
`Tampa, Florida 33602
`Telephone: 813/223-5505
`Facsimile: (813) 223-5402
`jyanchunis@forthepeople.com
`
` to seek pro hac vice admission
`Attorneys for Plaintiff and the putative
`class
`
` *
`
`
`
`
`
`
`
`
`UNITED STATES DISTRICT COURT
`CERNTRAL DISTRICT OF CALIFORNIA
`
`
`
`
`JOHN BAKER ORANGE on behalf of
`himself and all others similarly
`situated,
`
`
`
`
`
`CASE NO.:
`2:19-cv-10899
`
`CLASS ACTION
`
`COMPLAINT FOR DAMAGES,
`EQUITABLE, DECLARATORY,
`AND INJUNCTIVE RELIEF FOR:
`
`(1) NEGLIGENCE
`(2) INVASION OF PRIVACY
`(3) BREACH OF THE IMPLIED
`WARRANTY OF
`MERCHANTABILITY
`(4) BREACH OF IMPLIED
`CONTRACT
`(5) UNJUST ENRICHMENT
`(6) VIOLATION OF THE
`UNFAIR COMPETITION
`CLASS ACTION COMPLAINT
`
`1
`
`Plaintiff
`
`
`
`
`v.
`
`RING LLC and
`AMAZON.COM, INC.
`
`
`
`
`Defendant.
`__________
`
`
`
`
`
`
`
`
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`

`

`Case 2:19-cv-10899 Document 1 Filed 12/26/19 Page 2 of 30 Page ID #:2
`
`
`
`
`
`LAW (“UCL”) CAL. BUS.
`PROF. CODE § 17200
`
`
`
`DEMAND FOR JURY TRIAL
`
`
`Plaintiff John Baker Orange (“Plaintiff”), individually, by and through his
`
`undersigned counsel, brings this class action lawsuit against Ring LLC and
`Amazon.com, Inc. (collectively, “Defendants,” or “Ring”), on behalf of himself and
`all others similarly situated, and alleges, based upon information and belief and the
`investigation of his counsel as follows:
`JURISDICTION AND VENUE
`1.
`This Court has subject matter jurisdiction over this action under the Class
`Action Fairness Act, 28 U.S.C. § 1332(d)(2) because (a) the aggregated claims of
`putative class members exceeds $5 million, exclusive of interest and costs; (b) there
`are at least hundreds of putative class members; and (c) at least one of the members of
`the putative class is a citizen of a different state than Defendants.
`2.
`This Court has personal
`jurisdiction over Defendants because
`Defendants, directly or through their agents, conduct business in the State of
`California and within this District.
` Specifically, Defendant Ring maintains
`headquarters in this District and operate in this District. Through their business
`operations in this District, Defendants intentionally avail themselves of the markets
`within this District to render the exercise of jurisdiction by this Court just and proper.
`3.
`Through its business operations in this District, Defendants intentionally
`availed themselves of the markets within this District and have sufficient minimum
`contacts with this State to render the exercise of jurisdiction by this Court just and
`proper.
`4.
`Venue is proper in this Court pursuant to 28 U.S.C. § 1391(a)(1) because
`a substantial part of the events and omissions giving rise to this action occurred in this
`
`
`
`
`
`
`
`2
`
`CLASS ACTION COMPLAINT
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`

`

`Case 2:19-cv-10899 Document 1 Filed 12/26/19 Page 3 of 30 Page ID #:3
`
`
`
`District and Ring is headquartered in this District.
`
`INTRODUCTION
`
`5.
`Ring is a security and safety company which manufactures, markets and
`sells alarms, video doorbells, security systems, and cameras. At its core, Ring’s
`products are designed to promote the safety of its customers and to protect their
`privacy.
`6. Wi-Fi cameras are among Ring’s most popular offerings. They are
`designed to be strategically placed throughout a property, enabling authorized users to
`see covered areas in high definition and to communicate directly with occupants via a
`two-way speaker-microphone system.
`7.
`Ring promises its customers “peace of mind” with its Wi-Fi enabled
`smart security systems. Unfortunately, Ring’s cameras fail to deliver on its most basic
`promise. Lax security standards and protocols render its camera systems vulnerable to
`cyber-attack. Indeed, over the past several months numerous Ring customers reported
`that their camera systems had been hacked by malicious third parties who gained
`access to the video and two-way speaker-microphone system which they used to
`invade the privacy of customers’ homes and terrorize unsuspecting occupants, many
`of whom are children.
`8. While Ring quickly attempted to distance itself from liability by blaming
`customers for failing to create strong security passwords, it is Ring who failed to
`provide sufficiently robust security measures such as two-factor authentication and
`other protocols necessary to maintain the integrity and inviolability of its cameras. As
`a result of Ring’s defective design, and its failure to imbue its Wi-Fi cameras with
`sufficient security protocols, its customers’ most basic privacy rights were violated
`along with the security and sanctity of their homes.
`9.
`Plaintiff, on behalf of all others similarly situated, alleges claims for
`negligence, invasion of privacy, breach of implied contract, breach of implied
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`
`
`
`
`3
`
`CLASS ACTION COMPLAINT
`
`

`

`Case 2:19-cv-10899 Document 1 Filed 12/26/19 Page 4 of 30 Page ID #:4
`
`
`
`warranty and unjust enrichment. In addition, Plaintiff seeks damages, injunctive and
`
`declaratory relief.
`
`PARTIES
`10. Plaintiff John Baker Orange is a resident of Jefferson County Alabama.
`He purchased a Ring outdoor camera for his house in July 2019 for approximately
`$249.00. The Ring camera was installed over his garage with a view of the driveway.
`Mr. Orange purchased the Ring camera to provide additional security for him and his
`family which include his wife and three children aged 7, 9, and 10. Recently, Mr.
`Orange’s children were playing basketball when a voice came on through the
`camera’s two-way speaker system. An unknown person engaged with Mr. Orange’s
`children commenting on their basketball play and encouraging them to get closer to
`the camera. Once Mr. Orange learned of the incident, he changed the password on the
`Ring camera and enabled two-factor authentication. Prior to changing his password,
`Mr. Orange protected his Ring camera with a medium-strong password.
`11. Prior to the recent hacking incidents, Mr. Orange was unaware of and
`believes that Ring did not provide users the ability to secure their systems with two-
`factor authentication.
`12. Defendant Ring LLC is a home security and smart home company that
`manufactures a range of home security products including Wi-Fi enabled smart
`cameras. Ring LLC is a wholly owned subsidiary of Amazon.com with its place of
`business located at 1523 26th St, Santa Monica, California 90404.
`13. Defendant Amazon.com Inc. is a Delaware corporation headquartered at
`410 Terry Avenue North Seattle, Washington 98109-5210. Ring was acquired by
`Amazon in February 2018 for an estimated value of between $1.2 billion and $1.8
`billion.
`
`JURISDICTION AND VENUE
`14. This Court has subject matter jurisdiction over this action under the Class
`
`
`
`
`
`
`
`4
`
`CLASS ACTION COMPLAINT
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`

`

`Case 2:19-cv-10899 Document 1 Filed 12/26/19 Page 5 of 30 Page ID #:5
`
`
`
`Action Fairness Act, 28 U.S.C. § 1332(d)(2). The amount in controversy exceeds $5
`
`million, exclusive of interest and costs. There are thousands of putative class
`members, and at least some of whom have a different citizenship from Defendants.
`15. This Court has jurisdiction over the Defendants which operate in this
`District. Through their business operations in this District, Defendants intentionally
`avail themselves of the markets within this District to render the exercise of
`jurisdiction by this Court just and proper.
`16. Venue is proper in this Court pursuant to 28 U.S.C. § 1391(a)(1) because
`a substantial part of the events and omissions giving rise to this action occurred in this
`District and Ring is headquartered in this District.
`STATEMENT OF FACTS
`A. Ring Products and Wi-Fi Connectivity
`17. Ring offers a variety of Wi-Fi enabled security and safety devices, most
`notably video doorbells and cameras. The Ring video doorbell is the company’s
`flagship product. It is a smart doorbell that contains a high-definition camera, a
`motion sensor, a microphone and speaker for two-way audio communication. It
`integrates with an associated mobile app, which allows users to view real-time video
`from the camera, receive notifications when the doorbell is rung, and communicate
`with visitors at the door via the integrated speaker.
`18.
`In 2015, Ring released the first of its internal wireless IP cameras. Like
`the video doorbell, the cameras provide high definition video and microphone-speaker
`functionality for two-way communication. Since 2015, Ring has expanded its
`selection to include a range of indoor and outdoor cameras, each with video and two-
`way audio communication. 1
`19. Ring products are designed to operate through a users’ Wi-Fi network.
`
`1 https://support.ring.com/hc/en-us/sections/360006380112-Indoor-Cam
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`
`
`
`
`5
`
`CLASS ACTION COMPLAINT
`
`

`

`Case 2:19-cv-10899 Document 1 Filed 12/26/19 Page 6 of 30 Page ID #:6
`
`
`
`Once connected, the cameras enable users to see a high definition video stream in the
`
`camera’s range and listen to and/or communicate with nearby occupants.
`20. Creating a Ring account to fully enable the system involves a 4 step
`process: (1) download the Ring App; (2) Launch the app and click on the Setup
`Device button; (3) Create an Account at the bottom of the screen; (4) Enter your first
`and last name, email address and password.
`21. Ring cameras are relatively affordable, easy to install, simple to use, and
`heavily marketed by Amazon, making them one of the best-selling home security and
`surveillance devices on the market.
`22.
`In addition to their own direct-to-consumer marketing efforts, Ring has
`signed partnership agreements with hundreds of police departments around the
`country, many of which have marketed and sold Ring devices on the company’s
`behalf.
`23. Ring promises its customers “peace of mind” with “smart security here,
`there, everywhere.”2
`At the core of Ring, and guiding every action we take, is respect
`for the privacy and security of our neighbors (what we call our
`customers). This includes giving our neighbors effective, easy-
`to-use and affordable products and services to help protect their
`homes. It also means taking extremely seriously the privacy,
`security and control of their devices and personal information.
`Below you will find Ring’s guiding principles.
`
`We know you have many options to choose from so protecting
`your privacy and data security is a job we take seriously. We
`know that you place a huge amount of trust in us and we have
`every intention of continuing to earn that trust. 3
`
`
`
`
`2 https://shop.ring.com/pages/security-cameras
`3 https://shop.ring.com/pages/privacy
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`
`
`
`
`6
`
`CLASS ACTION COMPLAINT
`
`

`

`Case 2:19-cv-10899 Document 1 Filed 12/26/19 Page 7 of 30 Page ID #:7
`
`
`
`24. Unfortunately, Ring does not fulfill its core promise of providing privacy
`
`and security for its customers, as its camera systems are fatally flawed. The Ring
`system is Wi-Fi enabled, meaning that it will not work without internet connectivity.
`Once connected, however, any internet device can be seen by the on-line community,
`making it incumbent upon its manufacturer to design the device such that it can be
`properly secured for only intended use. This obligation is even more critical in
`instances where the device, like the Ring camera, is related to the safety and security
`of person and property.
`25. Ring failed to meet this most basic obligation by not ensuring its Wi-Fi
`enabled cameras were protected against cyber-attack. Notably, Ring only required
`users enter a basic password and did not offer or did not compel two-factor
`authentication.
`26. Dual factor or two-factor authentication (“2FA”) is a security process in
`which the user provides two different authentication factors to verify themselves to
`better protect both the user’s credentials and the resources the user can access. 2FA
`provides a higher level of assurance than authentication methods that depend on
`single-factor authentication, in which the user provides only one factor -- typically a
`password. 2FA adds an additional layer of security to the authentication process by
`making it harder for attackers to gain access to a person’s devices or online accounts,
`because knowing the victim’s password alone is not enough to pass the authentication
`check. Two-factor authentication has long been used to control access to sensitive
`systems and data, and online service providers are increasingly using 2FA to protect
`their users’ credentials from being used by hackers who have stolen a password
`database or used phishing campaigns to obtain user passwords.4
`27. Ring was certainly aware of the infirmity of its cameras and the necessity
`
`4 https://searchsecurity.techtarget.com/definition/two-factor-authentication
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`
`
`
`
`7
`
`CLASS ACTION COMPLAINT
`
`

`

`Case 2:19-cv-10899 Document 1 Filed 12/26/19 Page 8 of 30 Page ID #:8
`
`
`
`to employ good security practices which included, at a minimum, insistence on robust
`
`passwords and dual factor authentication.
`B. Hacking Incidents
`28. Over the past several weeks, news media has been inundated with reports
`of hackers gaining unauthorized access to homes across the country via insecure Ring
`devices. Once in, hackers routinely terrorizing occupants, invade their privacy and
`undermine their sense of safety and security. While the dramatic nature of these
`hacking incidents, which involved interactions between the hackers and occupants of
`the home, many of whom were children, caught the attention of mainstream media,
`the insecurity of the cameras poses an additional and more looming threat. Hackers
`who choose not to interact with occupants have gone unnoticed for days, month and
`even years during which time they spied on occupants and their homes, gathering an
`array of private which can subsequently be sold and used for a host of nefarious
`purposes:
`(a) Mississippi Incident
`
`Pedophile Hacker Hacked 8yo Girl’s Room – Told Her That
`He Is Santa Claus
`
`
`
`Parents will do anything to keep their child safe. This includes
`installing a CCTV inside the child’s room so that they can monitor
`their child while at work. However, for a couple in US, this move has
`caused their 8-year-old daughter to be harassed by a hacker.
`The mother, Ashley LeMay told CNN that she installed the camera
`so that she could make sure that they are OK while she’s at the
`overnight shift but four days after the camera was installed, a hacker
`managed to get through the system.
`From the CCTV footage, it can be seen that their daughter went into
`her room after hearing song being played from inside her room.
`Alyssa went on to ask who was playing the song and a voice came
`through the speaker of the camera. He said, “I’m your best friend.
`
`
`
`
`
`
`
`8
`
`CLASS ACTION COMPLAINT
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`

`

`
`
`
`
`Case 2:19-cv-10899 Document 1 Filed 12/26/19 Page 9 of 30 Page ID #:9
`
`I’m Santa Claus. Don’t you want to be my best friend?”
`
`When the couple’s 8-year-old daughter, Alyssa, checked on the
`music and turned on the lights, a man started speaking to her,
`repeatedly calling her a racial slur and saying he was Santa Claus.
`She screamed for her mother. 5
`
`“She won’t even sleep in her room,” Ms. LeMay said on Saturday.
`“She actually spent the night with a friend the other night because
`she didn’t want to be here.” “I did a lot of research on these before I
`got them. You know, I really felt like it was safe,”
`
` A big part of Ring's marketing strategy revolves around making
`customers feel like their own homes are unsafe, so that they’ll turn
`to surveillance devices to ease those fears. 6
`
`(b) Waterbury, Connecticut Incident
`
`Ed Slaughter told NBC Connecticut last week that he felt
`“violated” after a hacker started yelling obscenities and woke up
`his mother-in-law, who had been sleeping in the basement where
`he had installed a Ring camera. 7
`(c) Cape Coral, Florida Incident
`
`Josefine Brown told NBC 2 that she was frightened by an
`episode in which a hacker could be heard in footage from a Ring
`security camera provided to the station asking the interracial
`couple if their son was a “baboon.”
`
`In an email on Sunday, Ms. Brown said: “We are very
`
`5 How Hackers Are Breaking Into Ring Cameras, Vice, December 11, 2009,
`https://www.vice.com/en_us/article/3a88k5/how-hackers-are-breaking-into-ring-
`cameras
`6 https://www.worldofbuzz.com/pedophile-hacker-hacked-8yo-girls-room-cctv-in-the-
`us-told-her-that-he-is-santa-claus/ (December 15, 2019)
`7 Somebody’s Watching: Hackers Breach Ring Home Security Cameras, NY Times,
`December 15, 2019, https://www.nytimes.com/2019/12/15/us/Hacked-ring-home-
`security-cameras.html.
`
`
`
`
`
`
`
`
`9
`
`CLASS ACTION COMPLAINT
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`

`

`Case 2:19-cv-10899 Document 1 Filed 12/26/19 Page 10 of 30 Page ID #:10
`
`
`
`
`concerned about our safety and privacy because we thought
`having a security camera will keep us safe. We don’t know how
`long someone has been watching us. It is very scary.” Id.
`(d) Staten Island, New York Incident
`Gina Scarlato’s 13-year-old son, was terrorized by a hacker
`who followed the boy from camera to camera throughout
`the house. 8
`(e) North Texas Incident
` “The first thing that they heard was like a siren that went
`off,” said Lue Mayora of Forney. Wednesday night, while
`Mayora and her husband were coming home from work,
`someone hacked into their Ring cameras.
`They were shouting profanities, racial slurs and threats at their
`9-year-old and 11-year-old children who they said ran out of
`the house in terror.
`“I heard real, real screaming and I came out and said what’s
`going on,” Mayora’s neighbor Johnny Davila said. “They said
`someone is in house yelling they’re going to kill us.”
`Mayora’s neighbor got his gun and ran next door thinking
`someone was inside the home.
`As he heard the voice coming from the camera, he eventually
`realized it had been hacked.
`“It made me so mad that they’re targeting our kids,” he said.
`“They don’t want to sleep by themselves,” Mayora said.
`“They don’t want to be in the house.” Mayora has now
`deactivated her Ring cameras and said she will be getting rid
`
`
`8 Staten Island Family’s Ring Camera Hacked, CBS News NY, December 14, 2019,
`https://newyork.cbslocal.com/video/4236747-staten-island-familys-ring-camera-
`hacked/
`
`
`
`
`
`
`
`10
`
`CLASS ACTION COMPLAINT
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`

`

`Case 2:19-cv-10899 Document 1 Filed 12/26/19 Page 11 of 30 Page ID #:11
`
`
`
`
`of them this weekend.9
`(f) Georgia Incident
`A Georgia woman was given a terrifying wake-up call by a
`man who hacked into her Ring security camera and began
`speaking to her in the middle of the night.
`The woman was in bed when an unidentified man called to
`her through the camera, which she and her boyfriend
`installed to keep an eye on their new puppy, Beau, during
`working hours.
`In footage of the encounter, which a friend of the woman's
`shared on Twitter, the stranger can be heard clapping, calling
`to the puppy and telling the woman to “wake up!”
`“Hello? Hello? Come here, puppy,” he shouts.
`“Hello? Hello?” he says after multiple ignored commands. “I
`can see you in the bed, come on, wake the f*** up.” 10
`(g) Texas Incident
` Ring hackers demand $350,000 in Bitcoin from Texas
` Couple
`
`
` One of the most bizarre recent reports comes from Grand
`Prairie, Texas, where a couple says they awoke in the middle
`of the night to an alarm coming from their Ring camera. But
`that’s not all they heard; After the couple came to investigate,
`a voice over the Ring’s built-in speaker claimed that the
`couple’s Ring account had been terminated, and that they
`themselves would be “terminated” if they didn’t fork over a
`hefty haul of cryptocurrency.
`
`9 North Texas Family Furious After Ring Camera Hacker Terrorizes Their Children,
`https://texasbreakingnews.com/breaking/texas-family-furious-ring-camera-hacker-
`terrorizes-children/
`10 Yahoo, December 13, 2019, https://www.yahoo.com/now/woman-horrified-as-
`stranger-wakes-her-through-ring-security-camera-200838818.html
`
`
`
`
`
`
`
`11
`
`CLASS ACTION COMPLAINT
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`

`

`Case 2:19-cv-10899 Document 1 Filed 12/26/19 Page 12 of 30 Page ID #:12
`
`
`The “hackers” demanded a whopping 50 bitcoins. Going by
`the current conversion rate, that’s over $350,000.
`
` * * *
`[W]hat makes this whole thing scary is that they also gained
`control over the home’s Ring doorbell. They used their
`access to the doorbell to spoof their presence outside of the
`couple’s home, making
`the homeowners believe
`that
`someone was actually stalking
`their property while
`demanding the ransom.11
`C. Ring’s Response
`29.
`In response to the swath of hacking incidents across the country, Ring
`said only that it takes the security of its devices seriously, and then proceeded to
`blame Ring users for the hacking.
`“Our security team has investigated this incident and we have no
`evidence of an unauthorized intrusion or compromise of Ring’s
`systems or network,” the statement said. “Recently, we were
`made aware of an incident where malicious actors obtained
`some Ring users’ account credentials (e.g., username and
`password) from a separate, external, non-Ring service and
`reused them to log in to some Ring accounts.”12
`30. According
`to Ring,
`the hacked cameras were accessed when
`unauthorized third parties were able to login as authentic users with a proper
`password. Ring places the blame squarely on its customers suggesting these hacks are
`possible because people are using weak passwords that have previously been
`
`
`11 Ring hackers demand $350,000 in Bitcoin from Texas couple, but something so
`simple ruined their plot, BGR, December 12, 2019, https://bgr.com/2019/12/12/ring-
`hackers-texas-bitcoin-privacy-security/
`12 Somebody’s Watching: Hackers Breach Ring Home Security Cameras, NY Times,
`December 15, 2019
`
`
`
`
`
`
`
`12
`
`CLASS ACTION COMPLAINT
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`

`

`Case 2:19-cv-10899 Document 1 Filed 12/26/19 Page 13 of 30 Page ID #:13
`
`
`compromised.13
`
`31. By so doing, however, Ring ignores the fact that it allows its products –
`whose very purpose is to provide customers with safety and security – to be setup in a
`manner that makes it unreasonably susceptible to hacking.
`32. Although Ring is in the business of home security and was certainly
`aware that its Wi-Fi enabled product, was vulnerable to attack, it took no steps to
`“require camera owners to use two-factor authentication, which could help prevent
`these types of attacks…”14 Moreover, it knew, or should have known, in an era of
`pervasive data breaches, that logging in with user emails instead of unique account
`names, and not requiring at least 2FA, put its Wi-Fi enabled product at an
`unreasonable risk of being compromised.
`33. Not only was Ring aware that its cameras were inadequately secured, it
`was also aware of the existence of “online forums where hackers discussed how to
`break into Ring accounts connected to the cameras.” 15
`34. According to Motherboard,
`Ring was aware that the hacking community developed
`dedicated software for breaking into Ring security cameras. 16
`Indeed, several posts on different crime forums where hackers
`discuss creating tools for breaking into the Ring accounts which
`are connected to cameras.
`
`https://www.theguardian.com/technology/2019/dec/13/ring-hackers-reportedly-
`13
`watching-talking-strangers-in-home-cameras
`14 Hackers are getting really good at hacking Ring cameras and the results are
`terrifying, Mashable, December 15, 2019, https://mashable.com/article/ring-cameras-
`easily-hacked-and-its-terrifying/
`15
`https://www.theguardian.com/technology/2019/dec/13/ring-hackers-reportedly-
`watching-talking-strangers-in-home-cameras
`16 How Hackers Are Breaking Into Ring Cameras, Vice, December 11, 2009,
`https://www.vice.com/en_us/article/3a88k5/how-hackers-are-breaking-into-ring-
`cameras
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`
`
`
`
`13
`
`CLASS ACTION COMPLAINT
`
`

`

`
`
`Case 2:19-cv-10899 Document 1 Filed 12/26/19 Page 14 of 30 Page ID #:14
`
`
`
`
`‘Ring Video Doorbell Config,’ one thread on a hacking forum
`reads. A config is a file use to drive special software for rapidly
`churning through usernames or email addresses and passwords
`and trying to use them to log into accounts. Hackers have
`developed configs for a wide variety of websites and online
`services, from Uber to Facebook.
`
`The thread title adds that the config has a “High CPM,” or high
`“check per minute,” meaning it can test if a username and
`password allows access to a Ring camera quickly. In a different
`thread, one hacker is offering a Ring.com checker for $6.17
`35. Sadly, Ring hacking events have become so common place that there is
`even a podcast dedicated to live and recorded hacking events wherein malevolent third
`parties take control of Ring devices and terrorize occupants for entertainment.18 “The
`NulledCast is a podcast livestreamed to Discord.19 It's a show in which hackers take
`over people’s Ring and Nest smart home cameras and use their speakers to talk to and
`harass their unsuspecting owners.” 20 “‘Sit back and relax to over 45 minutes of
`
`
`17 How Hackers Are Breaking Into Ring Cameras, Vice, December 11, 2009,
`https://www.vice.com/en_us/article/3a88k5/how-hackers-are-breaking-into-ring-
`cameras
`18 Hackers are taking Control of Ring Cameras and using them to taunt both adults
`and children, Inc., https://www.inc.com/minda-zetlin/ring-camera-hacked-hackers-
`bitcoin-ransom-security.html
`19 Discord is a proprietary freeware voice over internet protocol application and digital
`distribution platform designed for video gaming communities, that specializes in text,
`image, video and audio communication between users in a chat channel. As of July
`2019, there are over 250 million unique users of the software.
`https://en.wikipedia.org/wiki/Discord_(software)
`20 Inside the Podcast that Hacks Ring Camera Owners Live on Air, Vice, December
`13, 2019, https://www.vice.com/en_us/article/z3bbq4/podcast-livestreams-hacked-
`ring-cameras-nulledcast.
`
`
`
`
`
`
`
`14
`
`CLASS ACTION COMPLAINT
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`

`

`Case 2:19-cv-10899 Document 1 Filed 12/26/19 Page 15 of 30 Page ID #:15
`
`
`entertainment,’ an advertisement for the podcast posted to a hacking forum called
`
`Nulled reads. ‘Join us as we go on completely random tangents such as; Ring & Nest
`Trolling, telling shelter owners we killed a kitten, Nulled drama, and more ridiculous
`topics. Be sure to join our Discord to watch the shows live.’” 21 As reported in
`Slashgear:
`
`Reality [] has taken on a frightening turn for owners of
`Ring security cameras who suddenly find virtual
`intruders in their homes, thanks to hackers who break
`into the security system and live stream their harassment
`for the entertainment of a few.
`
`The irony is probably lost on no one that the very devices
`that are supposed to keep homes and their owners safe
`have become the very vehicle for violations of their
`privacy. Tools to hack Ring security cameras have
`unfortunately become widespread enough to become
`almost common. And to show off their abilities and get a
`few kicks, some of these hackers have taken to live
`streaming their activities in bold defiance to authorities.
`22
`36. The podcast and other online hacker forums even feature software
`specifically designed to hack Ring cameras. The software churns through previously
`compromised email addresses and passwords to break into Ring cameras at scale. Id.
`37. Despite active knowledge of such forums Ring continued to blame these
`hacking incidents on poor security practices by users. Ring contends that in each of
`the hacking incidents, “credentials stolen during a data breach are sold on the black
`
`
`21 Nulledcast: a podcast where hackers play live audio of themselves breaking into
`Ring cameras and tormenting their owners, BoingBoing, December 13, 2019,
`https://boingboing.net/2019/12/13/nulledcast.html
`22 Ring camera hacking has become entertainment for some people, Slashgear,
`December 12, 2019, https://www.slashgear.com/ring-camera-hacking-has-become-
`entertainment-for-some-people-12603149/
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`
`
`
`
`15
`
`CLASS ACTION COMPLAINT
`
`

`

`Case 2:19-cv-10899 Document 1 Filed 12/26/19 Page 16 of 30 Page ID #:16
`
`
`market and used for hacking into accounts…. Due to the fact that customers often use
`
`the same username and password for their various accounts and subscriptions, bad
`actors often re-use credentials stolen or leaked from one service on other services."
`Ring’s explanation, however, neither eliminates its responsibility, nor accurately
`attributes the fault. As one hacking victim, Tania Amador, explained, her Ring
`password is 21 characters long and only used for that account. 23
`38. Moreover, “Ring’s status as a maker of home security cameras makes it
`much more sensitive than most accounts. Ring could probably do more to encourage
`users to choose strong passwords and set up two-factor authentication. For example,
`Google-owned Nest recently switches to Google logins, which have industry-leading
`security features. It also pesters people in the app to configure two-factor if they
`haven’t already.”24
`“Additionally, Ring does not alert users of attempted log-in from an
`39.
`unknown IP address, or tell users how many others are logged into an account at
`one time. Because of this, there is no obvious way to know whether any bad
`actors have logged into people’s compromised Ring accounts without their
`consent.”25
`40. Ring’s failure to employ good security practices in the design and
`implementation of its camera systems has directly resulted in the unlawful exposure of
`Plaintiff and Class Members’ person and property and has damaged them thereby.
`
`23 Hackers are taking Control of Ring Cameras and using them to taunt both adults
`and children, Inc., https://www.inc.com/minda-zetlin/ring-camera-hacked-hackers-
`bitcoin-ransom-security.html
`24
`https://www.extremetech.com/internet/303296-hackers-openly-peddle-tools-to-
`hack-ring-cameras
`https://www.buzzfeednews.com/article/carolinehaskins1/data-leak-exposes-
`25
`personal-data-over-3000-ring-camera-users
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`
`
`
`
`16
`
`CLASS ACTION COMPLAINT
`
`

`

`Case 2:19-cv-10899 Document 1 Filed 12/26/19 Page 17 of 30 Page ID #:17
`
`
`
`
`D.
`Plaintiff and Class Members Suffered Damages
`41. The ramifications of Defendant’s failure to properly secure their cameras
`and attendant access protocols may be felt for years to come. While the immediate in
`terrorem effects resulting from unauthorized access may be assuaged by disconnecting
`the camera, hackers have had access to information derived from those cameras for
`years, including but not limited to intimate details of household members, work
`schedules, and property contents. This information can be sold and used for a host of
`nefarious purposes.
`42. The hacking was a direct and proximate result of Ring’s failure to: (a)
`properly secure its camera systems in order to prevent, or at least minimize, the ability
`of unauthorized third parties to gain access; (b) establish and im

This document is available on Docket Alarm but you must sign up to view it.


Or .

Accessing this document will incur an additional charge of $.

After purchase, you can access this document again without charge.

Accept $ Charge
throbber

Still Working On It

This document is taking longer than usual to download. This can happen if we need to contact the court directly to obtain the document and their servers are running slowly.

Give it another minute or two to complete, and then try the refresh button.

throbber

A few More Minutes ... Still Working

It can take up to 5 minutes for us to download a document if the court servers are running slowly.

Thank you for your continued patience.

This document could not be displayed.

We could not find this document within its docket. Please go back to the docket page and check the link. If that does not work, go back to the docket and refresh it to pull the newest information.

Your account does not support viewing this document.

You need a Paid Account to view this document. Click here to change your account type.

Your account does not support viewing this document.

Set your membership status to view this document.

With a Docket Alarm membership, you'll get a whole lot more, including:

  • Up-to-date information for this case.
  • Email alerts whenever there is an update.
  • Full text search for other cases.
  • Get email alerts whenever a new case matches your search.

Become a Member

One Moment Please

The filing “” is large (MB) and is being downloaded.

Please refresh this page in a few minutes to see if the filing has been downloaded. The filing will also be emailed to you when the download completes.

Your document is on its way!

If you do not receive the document in five minutes, contact support at support@docketalarm.com.

Sealed Document

We are unable to display this document, it may be under a court ordered seal.

If you have proper credentials to access the file, you may proceed directly to the court's system using your government issued username and password.


Access Government Site

We are redirecting you
to a mobile optimized page.





Document Unreadable or Corrupt

Refresh this Document
Go to the Docket

We are unable to display this document.

Refresh this Document
Go to the Docket