Wyze’s problems with letting its security camera customers briefly see into other customer homes is a lot worse than we thought.
Last week, co-founder David Crosby said that “so far” the company had identified 14 people who were able to briefly see into a stranger’s property because they were shown an image from someone else’s Wyze camera. Now we’re being told that number of affected customers has ballooned to 13,000.
The revelation came from an email sent to customers entitled “An Important Security Message from Wyze,” in which the company copped to the breach and apologized, while also attempting to lay some of the blame on its web hosting provider AWS.
“The outage originated from our partner AWS and took down Wyze devices for several hours early Friday morning. If you tried to view live cameras or Events during that time, you likely weren’t able to. We’re very sorry for the frustration and confusion this caused.
The breach, however, occurred as Wyze was attempting to bring its cameras back online. Customers were reporting seeing mysterious images and video footage in their own Events tab. Wyze disabled access to the tab and launched its own investigation.
As it did before, Wyze is chalking up the incident to “a third-party caching client library” that was recently integrated into its system.
This client library received unprecedented load conditions caused by devices coming back online all at once. As a result of increased demand, it mixed up device ID and user ID mapping and connected some data to incorrect accounts.
But it was too late to prevent an estimated 13,000 people from getting an unauthorized peek at thumbnails from a stranger’s homes. Wyze says that 1,504 people tapped to enlarge the thumbnail, and that a few of them caught a video that they were able to view. It also claims that all impacted users have been notified of the security breach, and that over 99 percent of all of its customers weren’t affected.
Wyze customers are already airing their outrage on Reddit and elsewhere. One Reddit user, who described herself as a “23 year old girl” was getting ready for work during the breach, described herself as “disgusted and upset” and said she would be deleting her account. “I’m feeling so violated,” she said.
Wyze is scrambling to fix things by adding an additional layer of verification before users can view images or footage from the Events tab. “We have also modified our system to bypass caching for checks on user-device relationships until we identify new client libraries that are thoroughly stress tested for extreme events like we experienced on Friday,” the company’s email reads.
The email concludes with more apologies, including an acknowledgement that all of this will come as “disappointing news” to most of its users, whether they were affected by the breach or not. But that may not be enough to forestall any class action lawsuits that could stem from this.