InfoSecBulletin Cybersecurity for mankind
Amazon has agreed to pay nearly $31 million to the Federal Trade Commission (FTC) in order to resolve allegations related to its Alexa and Ring home security businesses.
The larger portion of the settlement, amounting to $25 million, will address accusations that Amazon violated the US Children’s Online Privacy Protection Act Rule (COPPA Rule) and misled Alexa customers about the deletion of data collected by the smart voice assistant.
Researcher found non protected database form ESHYFT containig 86000 records
CVE-2024-55591 and CVE-2025-24472
New SuperBlack ransomware exploits Fortinet flaws
CVE-2025-25291 & CVE-2025-25292
Attention! GitLab Patched Critical Authentication Bypass Flaws
CVE-2025-20138
Cisco released High Security Alert for IOS XR Software
400+ IPs Exploiting Multiple SSRF Vulnerabilities
NVIDIA has released update for NVIDIA Riva
CVE-2025-24201
Apple fixes 0-day exploited in “extremely sophisticated attack”
Microsoft’s March 2025 updates fix 7 zero-day, 57 flaws
Ballista Botnet infects 6000 Unpatched TP-Link Routers
CVE-2025-24813
Flaw in Apache Tomcat Exposes Servers to RCE
The Department of Justice (DoJ), acting on behalf of the FTC, filed a complaint stating that Amazon falsely assured users, including parents, that they could delete Alexa voice recordings and geolocation information. However, it was alleged that Amazon retained some of this data for extended periods and used it unlawfully to enhance the Alexa algorithm.
ALSO READ:
World see transmission at a record speed of 200 gigabits per second
Samuel Levine, the director of the FTC’s Bureau of Consumer Protection, stated that Amazon’s actions of misleading parents, retaining children’s recordings indefinitely, and disregarding deletion requests violated COPPA, prioritizing profits over privacy. He emphasized that COPPA prohibits companies from retaining children’s data indefinitely, especially for the purpose of training algorithms.
Separately, Ring, a business acquired by Amazon in 2018, will pay $5.8 million to settle charges related to compromising consumer privacy and failing to implement adequate security practices. The funds will be used for consumer refunds.
The FTC complaint alleged that Ring deceived customers by allowing unauthorized access to their videos by employees and contractors, and by using customer videos to train algorithms without consent. The complaint claimed that one employee had accessed thousands of video recordings from female users’ Ring cameras, including intimate spaces like bathrooms.
Furthermore, the complaint stated that Ring was slow to enhance customer account security to mitigate the risk of brute-force attacks, despite users experiencing multiple credential stuffing attacks in 2017 and 2018. The complaint highlighted that inadequate implementation of security measures from 2019 onwards hindered their effectiveness. As a result, malicious actors gained access to stored videos, live video streams, and account profiles of approximately 55,000 US customers, and even engaged in threats and extortion attempts.
In addition to the financial penalties, Amazon will be required to delete inactive child accounts, as well as certain Alexa voice recordings and geolocation information. The company will also be prohibited from using this data for training its algorithms.
Ring will be mandated to delete data, models, and algorithms derived from videos that were unlawfully reviewed. It will need to establish a privacy and security program, incorporating safeguards for human review of videos, multi-factor authentication for employee and customer accounts, and other protective measures.
Amazon issued a statement expressing disagreement with the FTC’s claims regarding Ring and Alexa and denying any violations of the law. The company emphasized its commitment to strong privacy protections and customer controls, its compliance efforts with COPPA, and its collaboration with the FTC before expanding Amazon Kids to include Alexa. Amazon acknowledged that, as part of the settlement, it agreed to make a minor adjustment to its existing practices, including the removal of inactive child profiles after 18 months, unless a parent or guardian opts to retain them. The statement further claimed that Ring had addressed the identified issues independently years ago, prior to the FTC’s investigation.
