Ethical Hacking News
US states sue popular kitmaker TP-Link over China risks, alleging that the company has made misleading security claims and has ties to China. The lawsuits, filed by attorneys general from Florida, Iowa, Montana, and Nebraska, claim that TP-Link's security assurances were deceptive and that the company's devices are vulnerable to exploitation by hackers. The case raises questions about the company's commitment to security and transparency and has sparked concerns among consumers and businesses alike.
US states have filed lawsuits against TP-Link, alleging misleading security claims and ties to China.The lawsuits claim TP-Link exploits devices by Chinese and Russian state-backed hackers and conceals facts about its Chinese connections.The company is accused of relying on Chinese companies for research and development and manufacturing operations, despite claiming to have severed ties with China.TP-Link's security assurances are deemed misleading due to critical vulnerabilities in its routers.The company's privacy policies permit collection of customer data and sharing with affiliates without disclosing how Chinese connections and China's intelligence laws could expose that information.
TP-Link, a leading manufacturer of networking and smart home devices, has found itself at the center of a storm as several US states have filed lawsuits against the company, alleging that it has made misleading security claims and has ties to China. The attorneys general of Florida, Iowa, Montana, and Nebraska have joined forces to sue TP-Link, accusing the company of deceptive and unfair marketing practices concerning its routers' security and its connections to China.
The lawsuit, which has been filed in federal court, accuses TP-Link of exploiting its devices by Chinese and Russian state-backed hackers, and of concealing facts about its "past and ongoing ties to the People's Republic of China." The complaint also claims that TP-Link has a supply chain that is reliant on PRC players, repeated firmware vulnerabilities, and is subject to Chinese laws that force companies to cooperate with state intelligence.
According to the states' attorneys general, the hardware vendor still relies on Chinese companies for research and development and manufacturing operations, despite previously claiming to have moved into Vietnam after severing ties with China. The complaint alleges that only 0.5 percent of components used at TP-Link's Vietnamese plant are bought in Vietnam, with "all other inputs" imported "from or through China."
The lawsuit cites 2025 testimony from former NSA cybersecurity director Rob Joyce, who stated that TP-Link's share of the US retail market for Wi-Fi systems and small-office/home-office (SoHo) routers was at least 60 percent. Lawyers pointed to various snippets from TP-Link's marketing materials, including claims that its HomeShield product "covers all security scenarios" and provides a "100 percent safeguard" for network security.
The complaint argues that TP-Link's security assurances were misleading because its routers contained critical vulnerabilities. It further cites Joyce's testimony that TP-Link routers were among the brands exploited in the China-linked Volt Typhoon and Flax Typhoon campaigns.
The lawsuit also alleges that TP-Link's privacy policies permit it to collect customer data and share it with affiliates without disclosing how its Chinese connections and China's intelligence laws could expose that information to Chinese intelligence agencies.
"Iowans' sensitive data and our national security are at risk because of TP-Link and their connection to the communist Chinese government," said Iowa Attorney General Brenna Bird. "TP-Link tells Iowans its routers are safe, our personal data is secure, and that they have no ties to China. They are not telling the truth. It's time to hold China and China-backed companies accountable."
"TP-Link's false statements and deceptive advertising are a violation of Montana law," said Attorney General Austin Knudsen. "As a result of their nefarious practices, millions of Americans have unknowingly invited a foreign adversary into their living rooms and put their personal information at risk."
In response to the lawsuits, Steve Kovsky, corporate affairs officer for TP-Link Systems Inc., said that the lawsuits were based on false premises, did nothing to advance national security, and unfairly penalized a US company. Kovsky added that the company has spent months providing officials with clear documentation showing that it is not owned or controlled by any foreign government and that its devices sold in the US are manufactured in Vietnam.
"Any claims that our products present a threat to user security or grant unauthorized network access to foreign governments are baseless," he said. "TP-Link Systems is a US company that complies with US privacy and data protection laws. We perform comprehensive security testing and rely on trusted third-party security labs for additional scrutiny to ensure our products meet the highest security standards and are recognized as among the most secure on the market."
TP-Link has a large presence in US retail and the tech channel, especially in consumer routers, with stats from Circana asserting it had around 36.6 percent US market share by units and 31 percent by dollars in 2024. The company has been a popular choice among consumers and businesses alike, with many touting its affordability and reliability.
However, the lawsuits have raised questions about the company's commitment to security and transparency. The allegations of misleading security claims and Chinese ties have sparked concerns among consumers and businesses, who may be vulnerable to exploitation by hackers.
The case against TP-Link highlights the need for greater transparency and accountability in the tech industry. As companies like TP-Link continue to grow and expand, they must be held to high standards of security and transparency.
The lawsuit is likely to have far-reaching implications for the tech industry and consumers. As the case unfolds, it remains to be seen whether TP-Link will be held accountable for its alleged misdeeds.
Related Information:
https://www.ethicalhackingnews.com/articles/US-States-Sue-TP-Link-Over-Alleged-Misleading-Security-Claims-and-Chinese-Ties-ehn.shtml
https://www.theregister.com/security/2026/10/07/us-states-sue-popular-kitmaker-tp-link-over-china-risks/5301653
Published: Wed Oct 7 14:13:39 2026 by llama3.2 3B Q4_K_M
