Wyze Suffers Third Major Privacy Breach Since 2022

Wyze's smart home and security products have had their recommendations suspended due to a significant privacy incident, the third of its kind since 2022. The latest event on February 16, 2024, resulted in around 13,000 Wyze customers incorrectly seeing thumbnail images from other users' cameras, with 1,504 customers viewing actual images and videos. This incident follows a breach five months prior and a March 2022 revelation about unaddressed security vulnerabilities.

This breach is particularly troubling as it appears to be a self-inflicted wound, where Wyze itself distributed private data to unintended recipients. This suggests a systemic problem rather than a targeted attack on its security. Compounding the issue, Wyze's customer notification email arrived nearly 48 hours after customers began flagging the problem on support forums, raising concerns about the company's response protocols.

Experts, including those from Carnegie Mellon University and Mozilla's Privacy Not Included, stress the critical need for companies like Wyze to be open and transparent about failures. While Wyze's co-founder acknowledged the need for better security and more investment in engineering staff, his defense of the delayed communication was met with skepticism. Quick, proactive alerts and advice are paramount in security and privacy matters.

To regain trust and have its products considered for recommendation again, Wyze must implement specific improvements. This includes immediate customer outreach via email and app notifications for emerging issues, frequent updates, interim protective advice, detailed explanations of resolved matters, and clear follow-ups. The company's track record now casts a shadow on the broader smart-home industry's trustworthiness.