Court Rules
All enforcement actions
SettlementMedium Risk

NY AG Secures $450K from eufy Distributors Over Insecure Video Streams

Fantasia Trading LLC, Power Mobile Life LLC, and Smart Innovation, LLCJanuary 28, 2025New York Attorney General

Penalty Amount

$450,000

Summary

New York Attorney General Letitia James secured a $450,000 settlement from three companies distributing eufy-branded home security cameras for failing to implement adequate data security measures. The companies’ cameras had unencrypted video streams accessible without authentication, exposing private consumer footage. The settlement requires the companies to implement stronger security protocols, including encryption, vulnerability testing, and a comprehensive information security program.

Remedy

The companies must pay $450,000 in penalties and costs. They are required to implement and maintain a comprehensive information security program protecting consumer data, use secure software development processes with third-party vulnerability testing tools, maintain a vulnerability management program including regular penetration and vulnerability testing, and implement appropriate encryption for video in storage and transit. The companies must also regularly substantiate to the NY AG that the eufy product developer meets these security requirements.

Monetary PenaltyCompliance ProgramAudit RequirementReporting Requirements

Contract Impact

In-house legal teams should review vendor agreements with IoT device manufacturers, smart home product distributors, and security camera providers to ensure robust data security requirements are included. Clauses related to encryption (both in transit and at rest), authentication protocols for user data access, vulnerability testing and penetration testing obligations, and requirements for comprehensive information security programs should be added or updated. Teams should also include provisions requiring vendors to promptly disclose security vulnerabilities, maintain audit trails of security testing, and provide regular compliance certifications to the company. Additionally, contracts should specify liability for data security failures that expose consumer private data, particularly video or other sensitive personal information.

Contract Search Terms

end-to-end encryptionvideo data securityvulnerability penetration testingauthentication protocolscomprehensive information security programthird-party security testingdata encryption in transitsecurity vulnerability management

Violation Types

Entity Details

Entity

Fantasia Trading LLC, Power Mobile Life LLC, and Smart Innovation, LLC

Also known as: eufy

Industry

Technology

Official Sources

Source Evidence

Entity Name
"The companies, Fantasia Trading LLC, Power Mobile Life LLC, and Smart Innovation, LLC distribute a line of video cameras, video doorbells, and video smart locks under the eufy brand."
Fine Amount
"pay $450,000 in penalties and costs"
Violation Types
"eufy Cameras’ Poor Data Security Left Private Home Security Footage Accessible to Outsiders"
Violation Types
"video streams from the cameras were not always securely encrypted and could be accessible to anyone with the relevant link without authentication."
Jurisdiction
"New York Attorney General Letitia James secured $450,000 from three companies that distribute eufy home security video cameras"
Event Type
"The settlement requires these companies to take steps to ensure stronger protections for customers’ data and pay $450,000 in penalties and costs."

Related Enforcement Actions

NY

BCMB1 Trust, First Age LLC, NS194 LLC, Second Start LLC, and Southern MBA Trust

$240K

The New York Attorney General investigated a group of debt buyers for filing foreclosure actions seeking payment of long-expired mortgage debts. The companies agreed to pay $240,000 in penalties and more than $242,000 in consumer restitution, stop seeking payment of time-barred debts, and amend claims in pending foreclosure cases.

NY

BCMB1 Trust; First Age, LLC; NS194, LLC; Second Start, LLC; Southern MBA Trust, and their affiliates

$240K

New York Attorney General Letitia James reached an agreement with debt buyers that allegedly filed foreclosure lawsuits seeking payment on expired mortgage debt. The companies must pay $240,000 in penalties and more than $242,000 in restitution, and stop seeking expired payments in ongoing and future cases.

NY

NovaTechFx and AWS Mining Pty Ltd.

$6.0M

The New York Attorney General secured disgorgement settlements totaling $5,975,861 from four promoters of NovaTech and AWS Mining over fraudulent investment claims and an illegal pyramid scheme. The promoters were permanently banned from the securities, commodities, and cryptocurrency industries; the Attorney General separately asked the court to order NovaTech’s founders to pay $1.3 billion, which was not yet an order.

NY

T-Mobile USA, Inc.

$98K

New York Attorney General Letitia James secured a settlement after T-Mobile raised prices on plans it had advertised with a promise that prices would never change. T-Mobile must offer affected customers refunds and other benefits, honor price guarantees through at least 2029 for customers who remain, clearly disclose limitations on future guarantees, and pay New York $98,000.

NY

Boston Children’s Health Physicians, LLP and XTIUM

$2.6M

New York and Connecticut reached a settlement with Boston Children’s Health Physicians and its IT security provider, XTIUM, after a 2024 breach exposed private information of approximately 825,000 New York residents and 62,871 Connecticut residents. The companies will pay $2.64 million and implement enhanced cybersecurity measures; additional penalties are conditional on violating the settlement.

NY

U.S. Department of Justice

New York Attorney General Letitia James joined 16 other attorneys general in urging Congress to pass proposed legislation addressing the federal government’s release of Jeffrey Epstein-related records. The press release says DOJ has not fully disclosed the records required by the original law and that personal information of at least 43 victims was exposed in released files; this is a legislative advocacy announcement, not an enforcement action imposing a penalty or remedy.