The FTC charged Ring with letting any employee or contractor access customers’ private videos and with failing to stop credential-stuffing and brute-force attacks that reached about 55,000 customers. The proposed order required a privacy and security program with safeguards on human review of videos and MFA for employee and customer accounts.
\nThe FTC’s May 31, 2023 press release on its Ring complaint says the agency charged the home security camera company with compromising customer privacy by allowing any employee or contractor to access consumers’ private videos. According to the complaint, one employee viewed thousands of recordings of intimate spaces over several months and was stopped only when another employee discovered it, and Ring could not determine how many other employees had inappropriately accessed videos because it had not implemented basic measures to monitor and detect employee video access.
\nThe complaint also says Ring failed to implement standard protections against credential stuffing and brute force attacks, adding multifactor authentication only in 2019 despite attacks in 2017 and 2018, and that hackers accessed stored videos, live streams and account profiles of about 55,000 customers and used two-way functionality to harass and threaten people, including children.
\nUnder the proposed order, which required federal court approval to take effect, Ring must delete data, models and algorithms derived from videos it unlawfully reviewed, implement a privacy and security program with safeguards on human review of videos and multi-factor authentication for employee and customer accounts, pay $5.8 million for consumer refunds, and alert the FTC about incidents of unauthorized access to customer videos.
\nUse this for any provider or in-house team with access to camera footage. The case concerns Ring’s practices and a stipulated order; it shows the FTC’s expectations rather than setting rules for every business.
\nDSE recommends limiting staff and contractor access to customer video to documented, approved tasks, logging and reviewing every access, and requiring MFA on all staff and customer accounts. Get customer consent before footage is used for analytics training or support review, alert on unusual viewing patterns, block credential stuffing with rate limits and breached-password checks, and include video access in offboarding.
\nReview video access logs monthly against support tickets, confirm MFA enforcement reports show no exempt accounts, and test that a departing employee’s access is removed on their last day.
\nFederal Trade Commission — FTC Says Ring Employees Illegally Surveilled Customers, Failed to Stop Hackers from Taking Control of Users’ Cameras (May 31, 2023). Reviewed October 18, 2026.
", "content_text": "The FTC charged Ring with letting any employee or contractor access customers’ private videos and with failing to stop credential-stuffing and brute-force attacks that reached about 55,000 customers. The proposed order required a privacy and security program with safeguards on human review of videos and MFA for employee and customer accounts.\nSource facts\nThe FTC’s May 31, 2023 press release on its Ring complaint says the agency charged the home security camera company with compromising customer privacy by allowing any employee or contractor to access consumers’ private videos. According to the complaint, one employee viewed thousands of recordings of intimate spaces over several months and was stopped only when another employee discovered it, and Ring could not determine how many other employees had inappropriately accessed videos because it had not implemented basic measures to monitor and detect employee video access.\nThe complaint also says Ring failed to implement standard protections against credential stuffing and brute force attacks, adding multifactor authentication only in 2019 despite attacks in 2017 and 2018, and that hackers accessed stored videos, live streams and account profiles of about 55,000 customers and used two-way functionality to harass and threaten people, including children.\nUnder the proposed order, which required federal court approval to take effect, Ring must delete data, models and algorithms derived from videos it unlawfully reviewed, implement a privacy and security program with safeguards on human review of videos and multi-factor authentication for employee and customer accounts, pay $5.8 million for consumer refunds, and alert the FTC about incidents of unauthorized access to customer videos.\nApplicability\nUse this for any provider or in-house team with access to camera footage. The case concerns Ring’s practices and a stipulated order; it shows the FTC’s expectations rather than setting rules for every business.\nDSE recommendation\nDSE recommends limiting staff and contractor access to customer video to documented, approved tasks, logging and reviewing every access, and requiring MFA on all staff and customer accounts. Get customer consent before footage is used for analytics training or support review, alert on unusual viewing patterns, block credential stuffing with rate limits and breached-password checks, and include video access in offboarding.\nVerification\nReview video access logs monthly against support tickets, confirm MFA enforcement reports show no exempt accounts, and test that a departing employee’s access is removed on their last day.\nOfficial reference\nFederal Trade Commission — FTC Says Ring Employees Illegally Surveilled Customers, Failed to Stop Hackers from Taking Control of Users’ Cameras (May 31, 2023). Reviewed October 18, 2026.", "content_markdown": "The FTC charged Ring with letting any employee or contractor access customers’ private videos and with failing to stop credential-stuffing and brute-force attacks that reached about 55,000 customers. The proposed order required a privacy and security program with safeguards on human review of videos and MFA for employee and customer accounts.\n\n## Source facts\n\nThe FTC’s [May 31, 2023 press release on its Ring complaint](https://www.ftc.gov/news-events/news/press-releases/2023/05/ftc-says-ring-employees-illegally-surveilled-customers-failed-stop-hackers-taking-control-users) says the agency charged the home security camera company with compromising customer privacy by allowing any employee or contractor to access consumers’ private videos. According to the complaint, one employee viewed thousands of recordings of intimate spaces over several months and was stopped only when another employee discovered it, and Ring could not determine how many other employees had inappropriately accessed videos because it had not implemented basic measures to monitor and detect employee video access.\n\nThe complaint also says Ring failed to implement standard protections against credential stuffing and brute force attacks, adding multifactor authentication only in 2019 despite attacks in 2017 and 2018, and that hackers accessed stored videos, live streams and account profiles of about 55,000 customers and used two-way functionality to harass and threaten people, including children.\n\nUnder the proposed order, which required federal court approval to take effect, Ring must delete data, models and algorithms derived from videos it unlawfully reviewed, implement a privacy and security program with safeguards on human review of videos and multi-factor authentication for employee and customer accounts, pay $5.8 million for consumer refunds, and alert the FTC about incidents of unauthorized access to customer videos.\n\n## Applicability\n\nUse this for any provider or in-house team with access to camera footage. The case concerns Ring’s practices and a stipulated order; it shows the FTC’s expectations rather than setting rules for every business.\n\n## DSE recommendation\n\nDSE recommends limiting staff and contractor access to customer video to documented, approved tasks, logging and reviewing every access, and requiring MFA on all staff and customer accounts. Get customer consent before footage is used for analytics training or support review, alert on unusual viewing patterns, block credential stuffing with rate limits and breached-password checks, and include video access in offboarding.\n\n## Verification\n\nReview video access logs monthly against support tickets, confirm MFA enforcement reports show no exempt accounts, and test that a departing employee’s access is removed on their last day.\n\n## Official reference\n\n[Federal Trade Commission — FTC Says Ring Employees Illegally Surveilled Customers, Failed to Stop Hackers from Taking Control of Users’ Cameras (May 31, 2023)](https://www.ftc.gov/news-events/news/press-releases/2023/05/ftc-says-ring-employees-illegally-surveilled-customers-failed-stop-hackers-taking-control-users). Reviewed October 18, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/ftc-ring-order-staff-access-customer-video-monitoring-mfa-video-providers/", "url": "https://update.dsesecurity.com/updates/ftc-ring-order-staff-access-customer-video-monitoring-mfa-video-providers/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-18" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/ftc-ring-order-staff-access-customer-video-monitoring-mfa-video-providers/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "FTC’s Ring case: restrict and monitor staff access to customer video, and require MFA for staff and customers", "item": "https://update.dsesecurity.com/updates/ftc-ring-order-staff-access-customer-video-monitoring-mfa-video-providers/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/ftc-ring-order-staff-access-customer-video-monitoring-mfa-video-providers/#article", "identifier": "https://update.dsesecurity.com/updates/ftc-ring-order-staff-access-customer-video-monitoring-mfa-video-providers/", "url": "https://update.dsesecurity.com/updates/ftc-ring-order-staff-access-customer-video-monitoring-mfa-video-providers/", "headline": "FTC’s Ring case: restrict and monitor staff access to customer video, and require MFA for staff and customers", "description": "The FTC charged Ring with letting any employee or contractor access customers’ private videos and with failing to stop credential-stuffing and…", "abstract": "The FTC charged Ring with letting any employee or contractor access customers’ private videos and with failing to stop credential-stuffing and brute-force attacks that reached about 55,000 customers. The proposed order required a privacy and security program with safeguards on human review of videos and MFA for employee and customer accounts.", "articleBody": "The FTC charged Ring with letting any employee or contractor access customers’ private videos and with failing to stop credential-stuffing and brute-force attacks that reached about 55,000 customers. The proposed order required a privacy and security program with safeguards on human review of videos and MFA for employee and customer accounts.\nSource facts\nThe FTC’s May 31, 2023 press release on its Ring complaint says the agency charged the home security camera company with compromising customer privacy by allowing any employee or contractor to access consumers’ private videos. According to the complaint, one employee viewed thousands of recordings of intimate spaces over several months and was stopped only when another employee discovered it, and Ring could not determine how many other employees had inappropriately accessed videos because it had not implemented basic measures to monitor and detect employee video access.\nThe complaint also says Ring failed to implement standard protections against credential stuffing and brute force attacks, adding multifactor authentication only in 2019 despite attacks in 2017 and 2018, and that hackers accessed stored videos, live streams and account profiles of about 55,000 customers and used two-way functionality to harass and threaten people, including children.\nUnder the proposed order, which required federal court approval to take effect, Ring must delete data, models and algorithms derived from videos it unlawfully reviewed, implement a privacy and security program with safeguards on human review of videos and multi-factor authentication for employee and customer accounts, pay $5.8 million for consumer refunds, and alert the FTC about incidents of unauthorized access to customer videos.\nApplicability\nUse this for any provider or in-house team with access to camera footage. The case concerns Ring’s practices and a stipulated order; it shows the FTC’s expectations rather than setting rules for every business.\nDSE recommendation\nDSE recommends limiting staff and contractor access to customer video to documented, approved tasks, logging and reviewing every access, and requiring MFA on all staff and customer accounts. Get customer consent before footage is used for analytics training or support review, alert on unusual viewing patterns, block credential stuffing with rate limits and breached-password checks, and include video access in offboarding.\nVerification\nReview video access logs monthly against support tickets, confirm MFA enforcement reports show no exempt accounts, and test that a departing employee’s access is removed on their last day.\nOfficial reference\nFederal Trade Commission — FTC Says Ring Employees Illegally Surveilled Customers, Failed to Stop Hackers from Taking Control of Users’ Cameras (May 31, 2023). Reviewed October 18, 2026.", "datePublished": "2026-10-18T21:00:10+00:00", "dateModified": "2026-10-18T22:22:06+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/ftc-ring-order-staff-access-customer-video-monitoring-mfa-video-providers/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/ftc-ring-order-staff-access-customer-video-monitoring-mfa-video-providers/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "FTC’s Ring case: restrict and monitor staff access to customer video, and require MFA for staff and customers" }, "articleSection": [ "Cybersecurity", "Video Surveillance" ], "keywords": [ "Cybersecurity", "Video Surveillance", "Briefing", "Important priority" ], "genre": "Briefing", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Video Surveillance", "url": "https://update.dsesecurity.com/topic/video-surveillance/" } ], "wordCount": 408, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Federal Trade Commission — FTC Says Ring Employees Illegally Surveilled Customers, Failed to Stop Hackers from Taking Control of Users’ Cameras (May 31, 2023)", "url": "https://www.ftc.gov/news-events/news/press-releases/2023/05/ftc-says-ring-employees-illegally-surveilled-customers-failed-stop-hackers-taking-control-users" } } ] } }