WASHINGTON (dpa-AFX) - Wyze Labs Inc., a Seattle-based maker of inexpensive smart-home devices and cameras, confirmed a data leak. This may impact millions of customers.
The data leak was first reported by cybersecurity company Twelve Security, which noted that both the production databases of Wyze were left entirely open to the Internet, exposing 'a significant amount of sensitive information generated by 2.4 million users.'
Wyze confirmed in a blog post that some user data was not properly secured and left exposed from December 4 to December 26. The company added that after receiving a report of a data leak on December 26 morning, it immediately restricted database access as well as began an investigation.
According to Wyze, the data leaked did not contain user passwords or government-regulated personal or financial information. However, it contained customer emails along with camera nicknames, WiFi SSIDs, Wyze device information, body metrics for a small number of product beta testers, and limited tokens associated with Alexa integrations. Wyze claimed this was not a production database.
The company said that as part of a new internal project, it copied some data from its main production servers and put it into a more flexible database.
While the new data table was protected when originally created, a Wyze employee using the database on December 4 mistakenly removed the previous security protocols for this data.
'There is no evidence that API tokens for iOS and Android were exposed, but we decided to refresh them as we started our investigation as a precautionary measure. Yesterday evening, we forced all Wyze users to log back into their Wyze account to generate new tokens,' Wyze said.
Wyze also unlinked all third party integrations that caused users to relink integrations with Alexa, The Google Assistant, and IFTTT to regain functionality of these services.
Further, the company is taking measures to improve camera security that will cause customers' camera to reboot in the coming days.
Wyze denied reports that it sends data to Alibaba Cloud and had a similar breach six months ago. The company also said it does not collect information about bone density and daily protein intake even from products that are currently in beta testing.
Copyright RTT News/dpa-AFX
© 2019 AFX News
