New York Attorney General Letitia James announced a settlement in which three companies have agreed to pay $450,000 after an investigation found their eufy home security cameras failed to adequately protect consumer privacy. The businesses, Fantasia Trading LLC, Power Mobile Life LLC, and Smart Innovation, LLC, faced scrutiny for not properly encrypting video feeds, leaving users' private videos exposed online. The settlement also mandates a series of actions to bolster data security for eufy-branded products.
"New Yorkers buy home security cameras to protect themselves and their homes," Attorney General James stated, pointing out a contradiction where the very devices meant to offer protection provided an opportunity for anyone with a URL to view someone else's security camera footage, as detailed by the Office of the New York State Attorney General. Found wanting, the security protocols for these devices allowed for unauthorized access to sensitive content, a pressing issue that the settlement aims to correct. Fantasia Trading, Power Mobile Life, and Smart Innovation are now bound by agreement to instate more rigorous protections.
Repercussions of this measure resonate not only in terms of monetary penalties but also in the requirement for these companies to engage in regular validity checks of the eufy home security products' developer's measures. These include comprehensive information security programs and encrypted video storage and transmission. This development was part of Attorney General James' ongoing effort to uphold consumer privacy and hold firms accountable for lax data security, her office noted in a press release.
The investigation kicked off when security flaws were disclosed by a researcher in November 2022, revealing that the eufy cameras' streams could be accessed without proper encryption or the need for authentication. Penalties and reforms ensued as New York Attorney General James makes clear that the expectation for businesses is to maintain not only promises of robust security but the reality of it. While protecting their pocketbooks, the companies involved are to make sure they consistently maintain a vulnerability management program and use secure software development processes, the probe uncovered by not having a way to test these practices appropriately.
Assistant Attorney General Nathaniel Kosslyn, Senior Enforcement Counsel Jordan Adler, and Deputy Bureau Chief Clark Russell from the Bureau of Internet and Technology handled this matter. Their efforts belong to a broader push within the Division for Economic Justice, led by Chief Deputy Attorney General Chris D’Angelo and overseen by First Deputy Attorney General Jennifer Levy, aiming to fortify New York consumers' digital privacy and security. This settlement represents another stride in this crucial domain of consumer advocacy.
