A hacker broke into one Mississippi family’s Ring security camera and used its speaker function to scare their 8-year-old daughter, local CNN affiliate WMC reported this week. This incident marks the latest in a recent series of reported Ring hacks wherein strangers terrorize users through their devices, and demonstrates reason number 1,467 why you might want to forego a Ring camera.
The camera had only been up for four days before the December 4 incident, purchased as part of a Black Friday deal, the girl’s mother Ashley LeMay told WMC. While her husband was home and she was out running errands, her 8-year-old daughter, Alyssa, heard something coming from her bedroom and went to investigate.
Since this hacker was apparently aiming for maximum creepiness, you can hear Tiny Tim’s rendition of “Tiptoe through the Tulips” blaring from the camera’s speaker as she enters the room in footage obtained by WMC (which you can watch here). When she asks who’s there, a man’s voice answers: “I’m your best friend. I’m Santa Claus. Don’t you want to be my best friend?” Clearly shaken at this point, she calls out for her mom as the stranger continues to taunt her and prompts her to tear up her room, per WMC’s report. Its a scene straight out of Paranormal Activity. Or any parent’s nightmare.
“I watched the video and I mean my heart just like ... I didn’t even get to the end where she is screaming ‘Mommy, mommy’ before I like ran inside,” LeMay told WMC. She then promptly disconnected the device.
Ring didn’t immediately respond to Gizmodo’s request for comment, but a company spokesperson assured CNN the hacker didn’t break in via a backdoor in Ring’s security.
“Customer trust is important to us and we take the security of our devices seriously. While we are still investigating this issue and are taking appropriate steps to protect our devices based on our investigation, we are able to confirm this incident is in no way related to a breach or compromise of Ring’s security,” a Ring spokesperson told CNN.
Instead, the company blamed lax account security on the family’s part as a likely cause, adding that: “As a precaution, we highly and openly encourage all Ring users to enable two-factor authentication on their Ring account, add Shared Users (instead of sharing login credentials), use strong passwords, and regularly change their passwords.” (LeMay told WMC she did not have two-factor authentification set up on her device). According to a Motherboard investigation, hackers have purportedly developed software aimed at exploiting these weak security points specifically to break into Ring accounts, access any connected devices, and wreak havoc.
And Ring’s no stranger to privacy concerns. Various Gizmodo reports have detailed the company’s extensive and controversial relationship with local police departments, one that has since earned the Amazon-owned company scrutiny from the U.S. government. A panel of five senators penned a letter to Amazon chief Jeff Bezos last month demanding to know more about how the company is protecting its users’ data. In addition to sharing users’ videos with law enforcement and its Ukraine-based research team, Ring’s previously been in hot water over exposing users’ home wi-fi passwords to hackers and possibly failing to keep Ring employees from using installed cameras to spy on users.