What Happened in the Ring Camera Hack? Complete Timeline and How to Protect Yourself

In December 2019, Ashley LeMay thought she was doing everything right. As a nurse working overnight shifts in Mississippi, she wanted a way to stay connected to her three daughters while she was at work. She researched security cameras extensively and finally purchased a Ring camera during a Black Friday sale.

Four days later, her worst nightmare became reality.

A stranger hacked into the camera installed in her 8-year-old daughter Alyssa's bedroom. For nearly 10 minutes, the hacker watched, talked to the child, played disturbing music, and used racial slurs. The terrifying incident wasn't isolated—it was part of a wave of Ring camera hacks that exposed serious vulnerabilities in devices millions of families trusted to keep them safe.

Watch the full investigation into the Ring camera security crisis:

The Night Everything Changed: December 4, 2019

Around 8 PM on December 4, 2019, Alyssa LeMay heard strange sounds coming from her bedroom in Nesbit, Mississippi. The third-grader thought it was her sister playing music. When she walked into the room, she found something far more disturbing.

The eerie melody of "Tiptoe Through the Tulips"—a song famously featured in the horror movie "Insidious"—was blaring from the Ring camera mounted on the wall. The confused child looked around the empty room and asked, "Who is that?"

A man's voice responded through the camera's speaker: "I'm your best friend. I'm Santa Claus."

The hacker proceeded to tell Alyssa she could "do whatever you want right now. You can mess up your room. You can break your TV." At one point, he demanded she call her mother a racial slur and told her to repeat it back to him.

The terrified girl screamed for her mother. By the time Ashley LeMay reviewed the footage, her heart sank. "I didn't even get to the end where she's screaming 'mommy,'" she told reporters.

The camera had only been installed for four days.

How Did Hackers Access Ring Cameras?

Ring initially claimed the incident was "in no way related to a breach or compromise of Ring's security." Instead, they blamed users for poor password practices.

According to Ring's statement: "When the same username and password is reused on multiple services, it's possible for bad actors to gain access to many accounts."

This explanation revealed a critical problem: Ring did not require two-factor authentication. Users could create accounts with weak passwords, reuse credentials from other breached websites, and Ring's system would accept them without additional verification.

Security experts later confirmed that hackers likely used a technique called "credential stuffing"—taking username and password combinations leaked from other data breaches and trying them on Ring accounts. Since many people reuse passwords across multiple sites, this method was devastatingly effective.

What Ring Didn't Do

A lawsuit filed by the LeMay family and other victims alleged that Ring failed to implement basic security measures:

• No mandatory two-factor authentication - Users weren't required to verify login attempts from new devices
• No alerts for suspicious logins - The system didn't notify users when someone logged in from an unknown IP address or location
• No rate limiting - Hackers could attempt thousands of password combinations without being blocked
• No forced password complexity - Weak passwords like "password123" were accepted

The lawsuit stated: "Ring's failure to take basic security precautions breached its duty to safeguard the highly sensitive information to which their users entrusted them."

This Wasn't an Isolated Incident

The LeMay family's nightmare was one of many similar attacks that emerged in late 2019 and early 2020:

Florida Family (December 2019)

A 15-year-old boy was subjected to racial slurs through a hacked Ring camera. The family told NBC affiliate WBBH they had to physically remove the batteries from the device. "I was scared. I didn't know who that is, how long he'd been watching us," said Josefine Brown.

Texas Couple (December 2019)

Craig and Amador were told by a hacker accessing their Ring camera that he was "standing outside their front door." The hacker demanded a bitcoin ransom and threatened "termination" if they didn't comply.

Georgia Family

Another family reported a hacker accessing their Ring doorbell camera and harassing them through the speaker system.

These incidents revealed a pattern: Ring's security infrastructure had fundamental weaknesses that hackers were systematically exploiting.

The Legal Fallout: Class Action Lawsuit

In late December 2019, multiple families—including the LeMays—filed a class-action lawsuit against Ring in the Central District Court of California.

The lawsuit alleged that Ring's security cameras had "created a living nightmare" by "permitting hackers to exploit security vulnerabilities in the Ring system to spy and harass Ring customers inside their homes."

The plaintiffs sought damages for:

• Emotional distress and trauma (especially for children like Alyssa)
• Invasion of privacy
• Negligence in implementing basic security measures
• Breach of implied warranty

The case drew national attention to the broader issue of IoT (Internet of Things) security and whether companies were doing enough to protect customers who trusted their devices.

Ring's Response and Changes

Following the wave of hacking incidents and subsequent lawsuits, Ring (owned by Amazon) began implementing security improvements:

January 2020: Mandatory Security Updates

• Two-factor authentication became opt-in - Ring began heavily encouraging (but not requiring) users to enable 2FA
• Control Center launched - A dashboard showing all devices and active login sessions
• End-to-end encryption announced - Video feeds would be encrypted from camera to user's device

February 2020: Additional Measures

• Login verification emails - Users received notifications when accounts were accessed from new devices
• Forced password resets - Users with weak or compromised passwords were required to create stronger ones

2021-2025: Ongoing Improvements

• Mandatory 2FA for new accounts (finally implemented in 2021)
• Advanced threat detection - Systems to identify and block credential stuffing attacks
• Privacy zones and mode - Allowing users to disable cameras without unplugging

However, critics argue these changes came too late for families like the LeMays, who were traumatized by Ring's initial security failures.

The Psychological Impact on Victims

Ashley LeMay described the aftermath in stark terms: "I did the exact opposite of adding another security measure. I put them at risk and there's nothing I can do to really ease their mind."

She couldn't tell her daughters who the hacker was. She couldn't promise he wouldn't show up at their house. The device meant to provide peace of mind had created lasting fear.

"They could have watched them sleeping, changing," LeMay told reporters. "I mean they could have seen all kinds of things. Honestly, my gut, it makes me feel like it's either somebody who knows us or somebody who is very close by."

For Alyssa, the 8-year-old at the center of the incident, the trauma was immediate and severe. She was terrified in her own bedroom—a space that should have been safe.

Security experts note that attacks on children through supposedly "safe" devices create a particular psychological burden: the violation of trust isn't just with the hacker, but with the technology itself and the parents who installed it.

How to Protect Your Smart Home Devices Right Now

If you own Ring cameras or any smart home devices, here are critical steps to protect yourself today:

1. Enable Two-Factor Authentication (2FA) Immediately

This is non-negotiable. Even if a hacker steals your password, 2FA prevents them from accessing your account.

• Open the Ring app → Account → Two-Factor Authentication → Enable
• Use an authenticator app (Google Authenticator, Authy) rather than SMS when possible

2. Create Strong, Unique Passwords

• Never reuse passwords across different accounts
• Use a password manager (1Password, Bitwarden, LastPass)
• Passwords should be 15+ characters with letters, numbers, and symbols
• Avoid personal information (names, birthdays, addresses)

3. Check Your Login History

• Ring app → Account → Control Center → Authorized Client Devices
• Remove any devices you don't recognize
• Review login locations and times for suspicious activity

4. Update Firmware Regularly

• Ring cameras receive security updates—make sure they're installed
• Check: Ring app → Device Settings → Device Health → Firmware

5. Secure Your Wi-Fi Network

• Change default router password
• Use WPA3 encryption (or WPA2 if WPA3 unavailable)
• Create a separate guest network for IoT devices
• Disable WPS (Wi-Fi Protected Setup)

6. Limit Camera Placement

• Never place cameras in bedrooms or bathrooms
• Focus on entry points: front door, back door, garage
• Consider privacy zones to block sensitive areas

7. Use Shared User Accounts Properly

• Don't share your primary login credentials with family members
• Create separate "Shared User" accounts for each person
• This limits access if one account is compromised

8. Monitor for Breach Notifications

• Use services like Have I Been Pwned to check if your email/password has been leaked
• If your credentials appear in a breach, change your Ring password immediately

What Security Experts Recommend

Jim McDonnell, a security consultant, summarized the situation bluntly: "Anything that can be accessed remotely can be hacked remotely. Encryption is the key. Systems that allow you to access smart devices through a third-party app are more vulnerable. Strong passwords are critical."

Additional expert recommendations:

• Assume everything connected to the internet is vulnerable - There is no such thing as 100% secure
• Practice defense in depth - Multiple layers of security (strong password + 2FA + network security)
• Minimize attack surface - Only connect devices that truly need internet access
• Regular security audits - Review your devices, passwords, and access logs quarterly

Frequently Asked Questions

Are Ring cameras safe now?

Ring has implemented significantly stronger security measures since 2019, including mandatory two-factor authentication for new accounts and improved threat detection. However, no internet-connected device is 100% secure. Users must enable 2FA, use strong passwords, and follow security best practices.

Can hackers still access Ring cameras in 2025?

If users have weak passwords, reuse credentials, or don't enable two-factor authentication, yes. The vulnerabilities exploited in 2019 still exist if basic security measures aren't followed. However, Ring's improved systems make attacks significantly harder.

Should I put Ring cameras in my child's bedroom?

Security experts strongly advise against placing any internet-connected cameras in bedrooms or bathrooms. Even with strong security, the risk of unauthorized access—whether by hackers, Ring employees, or government requests—outweighs the benefits. Use cameras only at entry points and common areas.

What happened to the hacker who terrorized the Mississippi girl?

The hacker was never publicly identified or arrested. This highlights a major challenge with cybercrime: attribution is difficult, and many perpetrators remain anonymous. The incident led to policy changes at Ring but no criminal prosecution was announced.

Did Ring face any penalties for the security failures?

Ring faced class-action lawsuits from affected families. The outcomes of these cases were not widely publicized, suggesting possible confidential settlements. In separate incidents, Amazon (Ring's parent company) paid $5.8 million in 2023 to settle FTC charges related to privacy violations and inadequate security practices.

How do I know if my Ring camera has been hacked?

Warning signs include:

• Camera moving or rotating without your input
• LED indicator light behaving unusually
• Unfamiliar voices coming from the speaker
• Unknown devices in your Control Center
• Increased data usage on your network
• Login notifications from unknown locations

What's the difference between Ring's security now versus 2019?

Key improvements:

• Mandatory 2FA for new accounts (optional in 2019)
• End-to-end encryption available (didn't exist in 2019)
• Login verification alerts (not implemented in 2019)
• Control Center dashboard (didn't exist in 2019)
• Improved rate limiting against credential stuffing

The Broader IoT Security Problem

The Ring camera hacks aren't isolated to one company. They represent a systemic problem with Internet of Things (IoT) devices:

• Nest cameras - In 2019, an Illinois family's Nest camera was hacked, with the intruder talking to their 7-month-old baby and turning the thermostat to 90 degrees
• Baby monitors - Numerous cases of hackers accessing baby monitors to spy on families and children
• Smart locks - Security researchers have demonstrated vulnerabilities in electronic door locks
• Smart speakers - Amazon Alexa and Google Home devices collecting audio when they shouldn't be listening

The common thread: convenience often comes at the cost of security and privacy. Companies rush products to market without adequate security testing, and consumers don't always understand the risks of connecting devices to the internet.

Conclusion: Security Is Your Responsibility Too

The Ring camera hack that terrorized 8-year-old Alyssa LeMay exposed serious corporate negligence. Ring should have implemented mandatory two-factor authentication, password complexity requirements, and suspicious login detection from day one.

But the incident also teaches an uncomfortable truth: in the connected home era, security is partially your responsibility.

Even the most secure systems can be compromised if users don't follow basic security hygiene:

• Enable two-factor authentication on every account
• Use strong, unique passwords
• Keep firmware updated
• Think critically about what devices truly need to be connected
• Never place cameras in private spaces like bedrooms

Ashley LeMay did extensive research before buying her Ring camera. She thought she was making her daughters safer. Instead, she inadvertently exposed them to a predator who watched her daughter's bedroom for who knows how long.

"I can't tell them I know who it is," LeMay said after the incident. "I can't tell them that they're not going to show up at our house in the middle of the night."

That nightmare doesn't have to be your reality. Take the security steps outlined in this article today. Your family's safety depends on it.

---

Want to see more investigations into tech security disasters and how to protect yourself? Watch the full breakdown of the Ring camera crisis and subscribe to The Next Curve for new videos every Tuesday and Friday.

Subscribe to The Next Curve on YouTube →

Last updated: February 2025

`