Amazon User Accidentally Receives 1,700 Recordings of Another User’s Alexa
December 21, 2018
A German Amazon user was accidentally sent another Alexa user’s 1700 audio recordings, in a malfunction Amazon is claiming is an “isolated incident” and a “result of human error”.
Following the passage of the European Union’s General Data Protection Regulation, or GDPR, any EU resident may demand a company send them the entirety of the data collected about them through both internet services and hardware products like an Alexa-equipped Echo smart speaker.
One German user, under the alias “Martin Schneider,” attempted to do just that, but instead, he returned home to thousands of Alexa voice recordings, even though he didn’t own an Alexa device.
Upon listening to the files, Schneider discovered they were the recordings of another Alexa user. After failing to get in contact with Amazon about the issue, the man brought the files to German Magazine c’t, where reporters were able to deduce who the Alexa user was. Among the many files were commands to control Spotify, the person’s home thermostat, and alarms. There were also recordings that indicated the Alexa user also owned a Fire TV, and that they had a spouse who appeared to live in the home.
“Using these files, it was fairly easy to identify the person involved and his female companion; weather queries, first names, and even someone’s last name enabled us to quickly zero in on his circle of friends,” the report reads. “Public data from Facebook and Twitter rounded out the picture.” It was later learned that the victim in this case also filed a data request under the new GDPR rules, c’t reports, but somehow the two men received each other’s reports.
Amazon released a statement regarding the leak, saying, “We have resolved the issue with the two customers involved and have taken steps to further improve our processes. We were also in touch on a precautionary basis with the relevant regulatory authorities.”
This isn’t the first time Amazon has had privacy scandals; An Echo device accidentally recorded an entire conversation between a Portland woman and her husband back in May, and then sent the conversation to a colleague of the husband’s.