Zoom shareholder accuses executives of fraud over security practices

An investor filed the class-action suit amid ongoing scrutiny of Zoom's data protection practices.

A Zoom shareholder has filed a lawsuit against the video-conferencing company for allegedly covering up security vulnerabilities in its app.

The suit, filed April 7 in a San Francisco federal court, accuses top Zoom executives of failing to disclose flaws in the company’s software, now used by some 200 million people daily. Zoom misrepresented problems with the software’s encryption protocol, failed to disclose that it was sharing user data with Facebook and concealed the extent to which user data was vulnerable to hackers, according to the suit.

Zoom chief executive Eric Yuan apologized for security issues in a blog post Monday, saying the company intends to improve its practices.

Investor Michael Drieu filed the lawsuit amid ongoing scrutiny of San Jose-based Zoom’s data protection practices. The number of daily users has skyrocketed, up from 10 million in early March, according to the company, as much of the world’s white-collar workforce has responded to the coronavirus pandemic by working from home. The sudden uptick, combined with Zoom’s apparent inability to encrypt video meetings, has given rise to “Zoombombing,” in which white supremacists and internet trolls barge into users’ meetings.

Zoom’s stock price fell by 19.62%, or $29.77, between March 27 and April 2, as questions about the software security were mounting. During that period, New York State Attorney General Letitia James announced her office would investigate the firm’s data protection practices, and the FBI issued a public bulletin about Zoombombing.

The suit filed Tuesday is a class action matter.

Security researchers also have probed Zoom’s software to find that the company routed data through servers in China, potentially providing its government with access to sensitive data. Zoom owned three companies in China that employed some 700 workers, allowing the company to save on U.S labor costs, though also rendering its services vulnerable to “pressure” from Chinese authorities, the University of Toronto’s Citizen Lab said in a report last week. The arrangement also contributed to a flawed encryption strategy that was “not suited for secrets,” Citizen Lab said.

Zoom has stopped using that strategy for non-Chinese data, it says. Company executives also have said they plan to introduce end-to-end encryption in the coming months.

The suit is available in full below.

[documentcloud url=”http://www.documentcloud.org/documents/6827644-Zoom-Shareholder-Suit-April-7.html” responsive=true]

Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

Elon Musk claimed he was aware of “literally zero” CSAM content created through Grok. A new lawsuit from thousands of real victims say the model was trained…

White House accuses Chinese company of distilling Anthropic’s Fable

Undressed victims file class action lawsuit against xAI for Grok deepfakes

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems