Four states sue TP-Link over router security and China ties

• Four state attorneys general filed separate consumer-protection lawsuits against TP-Link Systems on 6 October.
• Nebraska’s complaint names older TL-WR940N, Archer C7 and Archer AX21 routers and alleges misleading security claims.
• US agencies and Microsoft have documented cyber-attackers exploiting some TP-Link routers; that does not establish the company helped them.
• TP-Link says its US-market devices are made in Vietnam and that the company is independent of foreign governments.

The four states’ cases turn on what TP-Link told buyers about security, privacy and its connections to China. Iowa and Nebraska’s filings allege that the company overstated router protections and failed to disclose relevant business and supply-chain links. Florida and Montana also filed suits, according to Florida’s announcement and Montana’s attorney general. These are allegations under state consumer-protection laws, not court findings that TP-Link is controlled by China or shared customer data with its government.¹

Nebraska’s complaint identifies the TL-WR940N, Archer C7 and Archer AX21 among the models at issue. It cites TP-Link’s security marketing, including claims that its HomeShield service “covers all security scenarios”, and alleges that particular routers had vulnerabilities exploited in cyber operations. The claims concern specified models and versions; they do not establish that every TP-Link router, or every owner’s device, was compromised.²

There is evidence of real attacks on some TP-Link equipment. Microsoft said most of the routers in a compromised network it tracked as CovertNetwork-1658 were made by TP-Link. The network was used for password-spraying attacks, and Microsoft observed a Chinese threat actor using credentials obtained through those attacks to access organisations. Separately, the National Security Agency said Russian military intelligence hackers had compromised TP-Link routers using a known vulnerability. Neither account says TP-Link directed or knowingly enabled the attacks.³

TP-Link rejects the states’ claims. The company says its US-market devices are manufactured in Vietnam, that TP-Link Systems is an independent US company, and that it does not share customer network data with foreign governments. Those statements do not settle the states’ separate allegations about components, business relationships or disclosures.⁴

The filings and reporting do not give a reliable count of current TP-Link customers, routers still in use, or devices compromised in the states. Market-share estimates are not a count of affected households. On 7 October, Nebraska said 21 state attorneys general had separately urged the Federal Communications Commission to consider their concerns as it reviews TP-Link’s request for approval to sell new router models. That letter is a regulatory appeal, not a decision in the lawsuits; as of 8 October, the four cases had produced no verified ruling on their claims.⁵

Footnotes

1. Iowa Attorney General announcement; Nebraska Attorney General announcement; Montana Department of Justice announcement; Ars Technica report on Florida’s suit and the four cases. ↩

2. Nebraska’s filed complaint. ↩

3. Microsoft Threat Intelligence on CovertNetwork-1658; National Security Agency statement on Russian GRU router attacks. ↩

4. TP-Link’s response to the lawsuits. ↩

5. Nebraska Attorney General announcement and letter to the Federal Communications Commission. ↩