Ring Issues Password Resets After User Logins Found Online

Ring is issuing a forced password reset for at least 3,672 users after the login credentials to access their internet-connected cameras were found circulating on the internet.

Ring reset the passwords after an unnamed security researcher discovered the credentials on a text storage site, according to BuzzFeed. The list not only contains email addresses and passwords, but also the time zone and names affected users assigned to each Ring camera they own, such as "bedroom" or "front door."

Ring is stressing the company itself was not breached. Instead, it suspects a hacker compiled the list by harvesting login credentials exposed in past data breaches at other third-party sites. "It is not uncommon for bad actors to harvest data from other company's data breaches and create lists like this so that other bad actors can attempt to gain access to other services," Ring told PCMag in a statement.

The news occurs a week after a group of hackers hijacked several Ring cameras in the US to spy on and harass their owners. The cybercriminals have been found openly selling and circulating the login credential lists for Ring cameras on hacker forums.

Ring, which is owned by Amazon, blames the problem on users registering their cameras with weak passwords. However, security researchers say the company should be doing more to protect its customers, especially since Ring cameras have access to people's homes.

"They aren't even implementing the most basic of security controls to protect user accounts and they are trying to deflect blame by throwing their customers under the bus," tweeted Cooper Quintin, a security researcher at the Electronic Frontier Foundation.

One security measure Ring could institute is two-factor authentication. This would require anyone logging on to also type in a one-time passcode, generated on the customer's smartphone. The safeguard makes an account harder to breach at the expense of some convenience. But for now, Ring is only encouraging users to activate two-factor authentication rather than making it mandatory.

According to BuzzFeed, the unnamed security researcher who found the list tried to warn Ring about the login credentials first on the company's customer support number only to be told that the Ring representative was "unable to assist." The researcher then made a post on cybersecurity focused sub-forum on Reddit about the login list, which caught the eye of Ring security team member.

Ring says it's "continuing to monitor for and block potentially unauthorized login attempts" into customer accounts. Nevertheless, there may be more than one list of Ring login credentials circulating online. On Thursday, TechCrunch also reported on what appears to be a separate list containing 1,562 logins, which a hacker has posted on the dark web.

Recommended by Our Editors

Nest: Blame Weak Passwords, Not Us for Creepy Camera Incidents

To stay safe, it's best to activate two-factor authentication for any internet-connected camera. You should also use a hard-to-guess, unique passwords as your login.

Bootleg Ariana Grande album spreads malware