Controversies
Controversies tied to this brand in public sources. A listing is not a finding of fault.
Back to profile4 entries
2021
Cloud security incident and reporting dispute
A potential cloud-account breach led to disagreement between Ubiquiti and reporting by Brian Krebs over the extent of data exposure and the company’s public response. Prosecutors later charged a former senior employee in an alleged insider extortion scheme.
2021
Ubiquiti discloses unauthorized access to a cloud-hosted system
Issue disclosure
In January 2021, Ubiquiti informed customers that a system hosted by its third-party cloud provider had been accessed without authorization. The company warned that user data could be at risk as a result of the incident. According to Ubiquiti, the data potentially affected by the unauthorized access might include names, email addresses, and one-way encrypted passwords. The disclosure described the unauthorized access to the third-party cloud-hosted system and the categories of user data that could be involved, and it cautioned customers about the possible exposure of that information.
Ubiquiti told customers that a system hosted by its third-party cloud provider had been accessed without authorization and warned that user data could be at risk. The company said the data might include names, email addresses, and one-way encrypted passwords.
Company response
Clarification — Ubiquiti
该公司还建议用户还是应该更新自己的密码并启用双重身份验证
Source excerpt
Ubiquiti在发给客户的邮件中表示这些数据可能包括姓名、电子邮件地址和单向加密密码。
Ubiquiti近日在发给客户的一封邮件中表示，其第三方云供应商托管的系统遭到了未经授权的访问，因此用户需要注意数据泄露的风险
Ubiquiti, a manufacturer of products used for networks such as routers, webcams and mesh networks, announced this week that an unauthorized access to its systems hosted by a third-party cloud provider may have compromised customers’ name, email address and “the one-way encrypted password to your account” as well as address and telephone number if that also had been provided.
2015
Finance-department impersonation fraud
Ubiquiti disclosed a $46.7 million loss after criminals deceived finance personnel into transferring funds to an individual posing as an employee.
2013
U-Boot configuration exposure and GPL-source dispute
A vulnerability allowed plaintext device configuration data to be extracted through TFTP and an Ethernet connection. Ubiquiti was also criticized for not promptly publishing source code for GPL-licensed U-Boot components; the source was later released.