Security incidents & settlements tracker

Facts last verified · Every claim is linked to its source · Methodology

This page reports what companies and public records say, with links. It is informational and not legal advice.

Every entry is dated and linked to the company's own statement, a regulator, CISA/NVD, the original researcher, or reputable reporting. What qualifies is set by our incident inclusion rule: confirmed data exposure, regulator action, a serious vulnerability (in CISA's exploited list, or critical with a public exploit or write-up; patched ones still count), or confirmed undisclosed sharing or retention. A brand with any qualifying entry from October 2021 onward loses the 5 "no incidents" points; older entries are listed but not scored. This tracker is not exhaustive. Missing something? See our corrections policy.

DateCompanyWhat happenedType
Jun 2026AqararunZero published CVE-2026-50083 (NVD CVSS 9.8) and related flaws in Aqara's cloud login and API services, including hardcoded OAuth credentials that could be chained to take over accounts and devices. Aqara said the issues were fixed in April 2026.12Serious vulnerability
May 2026Ubiquiti UniFiUbiquiti disclosed critical (CVSS 10.0) UniFi OS flaws (CVE-2026-34908/34909/34910) affecting consoles and NVRs that run UniFi Protect; chained, they give unauthenticated root access. CISA added them to its Known Exploited Vulnerabilities catalog on June 23, 2026. Patched.345Serious vulnerability
Feb 2026Google NestIn the Nancy Guthrie case, the FBI said it recovered Nest doorbell video "from residual data located in backend systems" with Google's help, after a search warrant, although the owner had no subscription. Free Nest history is documented as about 3 hours.678Undisclosed sharing / retention
Dec 2025AqaraCVE-2025-65294 (CVSS 9.8): researchers documented an undocumented remote command-execution mechanism in Aqara hubs and camera hubs. Their regression testing reports it removed from the Camera Hub G3 but still present in the G4 doorbell firmware they tested.910Serious vulnerability
Aug 2025ReolinkCVE-2025-55637: command injection (NVD CVSS 9.8) in a Reolink Wi-Fi video doorbell (Smart 2K+ Plug-in with Chime), published with a researcher proof-of-concept write-up.11Serious vulnerability
Jan 2025eufy (Anker)eufy's US distributors paid $450,000 to settle a New York Attorney General investigation over unencrypted streams.12Regulator action
Dec 2024LorexRapid7 disclosed five flaws in the Lorex 2K Indoor Wi-Fi Security Camera, led by CVE-2024-52544 (unauthenticated stack buffer overflow, CVSS 9.8), that chain to unauthenticated remote code execution, with a public exploit. Lorex released fixed firmware.1314Serious vulnerability
Apr 2024Ring (Amazon)FTC sent more than $5.6M in refunds to 117,044 Ring customers from the 2023 settlement.15Regulator action
Feb 2024WyzeAbout 13,000 users were shown thumbnails from other people's cameras after an outage; 1,504 tapped them.1617Data exposure
Dec 2023Ubiquiti UniFiA cloud misconfiguration let some UniFi users see other customers' Protect notifications/consoles for several hours.18Data exposure
Sep 2023WyzeWeb View caching issue: up to 2,300 users may have seen feeds from 10 users' cameras for about 40 minutes.1920Data exposure
May 2023Ring (Amazon)FTC complaint and settlement: Ring to pay $5.8M; employees/contractors accessed customer videos and hackers took over about 55,000 US customers' accounts. Ordered to delete pre-2018 videos and face data.2122Regulator action
Nov 2022eufy (Anker)Researchers showed eufy uploaded thumbnails to the cloud and that live streams could be viewed in VLC without proper authentication.2324Undisclosed sharing / retention
Sep 2022EZVIZBitdefender disclosed EZVIZ camera flaws including CVE-2022-2471, a remote stack buffer overflow in motion detection (NVD CVSS 9.8) that, chained with others, let an attacker control cameras and download images. EZVIZ confirmed fixes in 2022.2526Serious vulnerability
Jul 2022Ring (Amazon)Amazon told Sen. Markey that Ring gave police footage without user consent 11 times in 2022 under its emergency exception.272829Undisclosed sharing / retention
Jun 2022eufy (Anker)Cisco Talos disclosed another critical (CVSS 9.8) remote-code-execution flaw in eufy HomeBase 2 (CVE-2022-21806) with technical details.30Serious vulnerability
Mar 2022WyzeBitdefender disclosed an authentication bypass (CVE-2019-9564, CVSS 9.8) and remote code execution flaw in Wyze Cam v1/v2/v3 with a technical write-up; v2/v3 were patched, the discontinued Cam v1 was not.3132Serious vulnerability
Mar 2022TP-Link (Tapo, Kasa)CVE-2021-4045: unauthenticated remote code execution (CVSS 9.8) in the Tapo C200 camera (firmware 1.1.15 and below); the researcher published a write-up and exploit code. Fixed in later firmware.3334Serious vulnerability
Jan 2022ReolinkCisco Talos disclosed critical command-injection and firmware flaws in the Reolink RLC-410W camera with technical details. In December 2024 CISA added CVE-2021-40407 from this batch to its Known Exploited Vulnerabilities catalog.3536Serious vulnerability
Nov 2021AmcrestCISA added CVE-2020-5735 (Amcrest cameras and NVRs, stack buffer overflow on port 37777, CVSS 8.8) to its Known Exploited Vulnerabilities catalog, meaning it was exploited in the wild. First disclosed in 2020; patched firmware exists.37Serious vulnerability
Oct 2021eufy (Anker)Cisco Talos disclosed critical eufy HomeBase 2 flaws, starting with CVE-2021-21940 (heap overflow in the RTSP video server, CVSS 10.0), with technical details; Talos lists the vendor patch as October 10, 2021.38Serious vulnerability
Dec 2019WyzeWyze server leak exposed data on about 2.4 million users.39Data exposure (before window, not scored)

Considered but not scored

Informational only, not legal advice. Found an error? Tell us.

Sources

  1. NVD: CVE-2026-50083 (Aqara cloud hardcoded OAuth credential) · checked Oct 22, 2026
  2. runZero advisory: Aqara hardcoded OAuth client credentials · checked Oct 22, 2026
  3. Canadian Centre for Cyber Security: Ubiquiti advisory AV26-498 · checked Oct 22, 2026
  4. CISA: Adds four known exploited vulnerabilities (Jun 23, 2026) · checked Oct 22, 2026
  5. Bishop Fox: Unauthenticated RCE chain on UniFi OS · checked Oct 22, 2026
  6. CNN: How Google helped recover video from Nancy Guthrie's cameras (Feb 2026) · checked Oct 22, 2026
  7. The Verge: FBI releases recovered footage from Nancy Guthrie's Nest cam (Feb 2026) · checked Oct 22, 2026
  8. Google Store: Nest Doorbell · checked Oct 22, 2026
  9. NVD: CVE-2025-65294 (Aqara hubs undocumented remote execution) · checked Oct 22, 2026
  10. Researcher write-up: Aqara undocumented remote execution (CVE-2025-65294) · checked Oct 22, 2026
  11. NVD: CVE-2025-55637 (Reolink Wi-Fi Video Doorbell command injection) · checked Oct 22, 2026
  12. NY Attorney General: $450,000 eufy settlement (Jan 2025) · checked Oct 22, 2026
  13. Rapid7: Lorex 2K Indoor Wi-Fi Security Camera vulnerabilities (Dec 2024) · checked Oct 22, 2026
  14. NVD: CVE-2024-52544 (Lorex 2K Indoor Wi-Fi camera) · checked Oct 22, 2026
  15. FTC: Refunds to Ring customers (Apr 2024) · checked Oct 22, 2026
  16. Wyze forum: Update on 2/16/24 security issue · checked Oct 22, 2026
  17. The Verge: 13,000 Wyze customers saw into other homes (Feb 2024) · checked Oct 22, 2026
  18. TechCrunch: Ubiquiti glitch exposed video to other customers (Dec 2023) · checked Oct 22, 2026
  19. Wyze forum: Web View service advisory (Sep 8, 2023) · checked Oct 22, 2026
  20. The Verge: Wyze Web View issue showed other users' feeds (Sep 2023) · checked Oct 22, 2026
  21. FTC: Ring employees illegally surveilled customers (May 31, 2023) · checked Oct 22, 2026
  22. FTC case page: Ring LLC · checked Oct 22, 2026
  23. The Verge: Eufy streams viewable in VLC (Nov 2022) · checked Oct 22, 2026
  24. eufy: Statement to our community (Nov 2022) · checked Oct 22, 2026
  25. Bitdefender Labs: Vulnerabilities identified in EZVIZ smart cams (Sep 2022) · checked Oct 22, 2026
  26. NVD: CVE-2022-2471 (EZVIZ motion-detection stack overflow) · checked Oct 22, 2026
  27. AP: Amazon gave Ring footage to police without consent (Jul 2022) · checked Oct 22, 2026
  28. The Verge: Which camera companies share video without a warrant (Jul 2022) · checked Oct 22, 2026
  29. Sen. Markey: Probe into Amazon Ring reveals new privacy problems (Jul 2022) · checked Oct 22, 2026
  30. Cisco Talos: eufy HomeBase 2 use-after-free (TALOS-2022-1440) · checked Oct 22, 2026
  31. Bitdefender: Vulnerabilities identified in Wyze Cam (Mar 2022) · checked Oct 22, 2026
  32. Wyze: Response to 3/29/22 security report · checked Oct 22, 2026
  33. NVD: CVE-2021-4045 (Tapo C200 unauthenticated RCE) · checked Oct 22, 2026
  34. hacefresko: Finding an RCE in the Tapo C200 (CVE-2021-4045) · checked Oct 22, 2026
  35. Cisco Talos: Reolink RLC-410W OS command injection (TALOS-2021-1424) · checked Oct 22, 2026
  36. NVD: CVE-2021-40407 (Reolink RLC-410W; in CISA KEV) · checked Oct 22, 2026
  37. NVD: CVE-2020-5735 (Amcrest cameras/NVR; in CISA KEV) · checked Oct 22, 2026
  38. Cisco Talos: eufy HomeBase 2 heap overflow (TALOS-2021-1369) · checked Oct 22, 2026
  39. The Verge: Wyze server leak exposed 2.4M users' data (Dec 2019) · checked Oct 22, 2026
  40. Texas AG: Paxton sues TP-Link (Feb 17, 2026) · checked Oct 22, 2026
  41. TP-Link: Security advisory on Tapo C100, C425, C200 and C520WS (CVE-2025-8065, CVE-2025-14299, CVE-2025-14300) · checked Oct 22, 2026
  42. Sen. Markey: calls on Amazon to end facial recognition in Ring (Feb 2026) · checked Oct 22, 2026