Amazon-owned Ring denies ‘ransomware event’ following darknet listing

The smart doorbell and security camera company Ring has denied that it suffered a ransomware attack after the company was listed on a prominent ransomware gang’s extortion site.

The ALPHV ransomware group, also known as BlackCat, added the listing for Ring to its site late on Monday evening, adding: “There’s always an option to let us leak your data.”

But a spokesperson for Ring, which is owned by Amazon, told Recorded Future News: "We currently have no indications that Ring has experienced a ransomware event."

Read more: An ALPHV (BlackCat) representative discusses the group’s plans for a ransomware ‘meta-universe’

It is not clear what data the gang claims to have accessed.

Ring has historically experienced a number of incidents in which hackers were able to access customers’ cameras after compromising their credentials, although the company has now updated its security practices.

Vice News reported that a person shared a link to their report in an internal Amazon Slack channel with the statement: “Do not discuss anything about this. The right security teams are engaged.”

Under the EU's General Data Protection Regulation (GDPR), companies have 72 hours to confirm a breach of personal data to victims after discovering it, or they can face large fines. Such a breach could include losing access to personal data if it was encrypted, as well as the criminals managing to steal it for extortion purposes.

When asked about GDPR, the company spokesperson responded that there were currently "no indications" of a ransomware incident.

Last month ALPHV listed just over 6GB of data allegedly stolen from the Munster Technological University in Ireland in an attack which led to all classes being canceled for several days.

The FBI issued a Flash report regarding the BlackCat/ALPHV ransomware gang in April 2022, warning: “Many of the developers and money launderers for BlackCat/ALPHV are linked to Darkside/Blackmatter, indicating they have extensive networks and experience with ransomware operations.”