Between 4 December and 26 December 2019, production databases belonging to smart‑home maker Wyze were left open to the internet. The breach, discovered by security firm Twelve Security, exposed the personal data of roughly 2.4 million customers. Wyze co‑founder Dongsheng Song later confirmed the timeline and cause in a company blog post.
The incident was not the result of a sophisticated cyber‑attack. An employee copied data into a new database and failed to transfer the necessary security settings.
The unsecured databases remained publicly accessible for 23 days before the lapse was identified. Information made publicly reachable included user names, email addresses, details about home cameras and authentication tokens used by smartphones. Song emphasized that passwords and financial details were not part of the exposed data set.
Although passwords were absent, the released identifiers are valuable to malicious actors. Email addresses and usernames can be leveraged for phishing campaigns, and knowledge that a specific individual owns a Wyze camera adds a layer of credibility to such attacks.
The data could also be sold or otherwise weaponized, raising the risk of targeted scams for the affected customers. Wyze, founded in 2017 by three former Amazon employees, built its brand on inexpensive, easy‑to‑use smart‑home products. Trust was a core component of its market appeal, as consumers allowed cameras into living rooms, nurseries and front doors.
The breach therefore strikes at the heart of the company’s value proposition. In response, Wyze forced a logout of all accounts and required users to sign in again.
The firm also sent email notifications to customers, a standard damage‑control measure but one that does little to restore confidence. The episode underscores a broader industry pattern where rapid feature rollout often outruns security considerations. The employee’s mistake likely stemmed from an effort to fix a bug or test a new function quickly, without ensuring that protective configurations migrated to the new database. Long‑term repercussions remain uncertain.
Smart‑home providers rely heavily on recurring revenue and word‑of‑mouth referrals; a breach of this magnitude could deter potential buyers and give competitors a marketing advantage. While the United States lacks a comprehensive federal data‑privacy statute, state attorneys general have become more active, and Wyze could face regulatory scrutiny, fines or lawsuits.
For the 2.4 million users whose data was disclosed, standard protective steps are advised: remain vigilant for phishing attempts, change passwords and enable two‑factor authentication where possible. However, such measures cannot undo the fact that personal information is already circulating. The Wyze incident serves as a reminder that, in the race to connect more devices, fundamental security practices must not be overlooked.
Even a company founded by veterans of a major tech firm can fall short when “knowing better” does not translate into “doing better.” One employee’s oversight has left millions of customers exposed and the company facing the consequences.
{“@context”: “https://schema.org”, “@type”: “NewsArticle”, “headline”: “Wyze data leak exposes 2.4 million users due to human error”, “description”: “Between 4 December and 26 December 2019, production databases belonging to smart‑home maker Wyze were left open to the internet. The breach, discovered by secur”, “datePublished”: “2026-06-25T09:30:00+00:00”, “author”: {“@type”: “Person”, “name”: “Reza Karimi”}, “publisher”: {“@type”: “Organization”, “name”: “InfoPulse Today”, “url”: “https://newsfeed.infopulsetoday.com/”}, “image”: “https://freesuntimes.com/wp-content/uploads/sites/20/2026/05/wyze-data-leak-exposes-2-4-million-customers-a-group.jpg”}
