Two couples who say their home security cameras were hacked filed a class-action lawsuit against Ring LLC for invasion of privacy and negligence.
Ashley LeMay and her husband, Dylan Blakeley, said in December that a stranger hacked a camera they set up in their 8-year-old daughter's bedroom and taunted the child. Todd Craig and his girlfriend, Tania Amador, said that same month a hacker threatened them with "termination" if they did not pay a ransom.
Both couples filed the suit last week in the Central District Court of California, saying Ring's security cameras have "created a living nightmare."
"Instead of helping families protect their homes, Ring security devices have had the opposite effect by permitting hackers to exploit security vulnerabilities in the Ring system to spy and harass Ring customers inside their homes," the suit claims.
LeMay, of Mississippi, said her family had recently installed a camera in their children's bedroom to keep an eye on their daughters. A few days after the device was put in the room, a stranger gained access to it and started talking to their young daughter.
Let our news meet your inbox. The news and stories that matters, delivered weekday mornings.
At one point, the stranger told the girl he was Santa Claus and instructed the child to mess up her room and break her television. According to the lawsuit, the hacker also played a song from the horror film "Insidious."
Ring said in a statement in December that: "While we are still investigating this issue and are taking appropriate steps to protect our devices based on our investigation, we are able to confirm this incident is in no way related to a breach or compromise of Ring’s security."
A Ring spokesperson told NBC News on Friday that the company does not comment on legal matters.
Craig and Amador, of Texas, said the person who hacked their camera told the couple that he was standing outside their front door, the lawsuit states. The hacker also demanded they pay a bitcoin ransom and said they would face "termination" if they didn't comply.
The suit alleges that Ring, which is owned by Amazon, does not require customers to implement two-factor authentication for extra security and does not check when someone logs into an account from an unknown IP address.
"Ring's failure to take basic security precautions breached its duty to safeguard the highly sensitive information to which their users entrusted them," the lawsuit says.
The couples are seeking damages.
News of the lawsuit comes on the heels of Amazon's Brian Huseman saying that at least four Ring employees were terminated for violating company policy about access to video data.
"Although each of the individuals involved in these incidents was authorized to view video data, the attempted access to that data exceeded what was necessary for their job functions," he said in a Jan. 6 letter this month to five Democratic senators.
Huseman's letter was in response to the senators' writing Amazon CEO Jeff Bezos seeking information on the company's privacy and data-security practices.