Four states sued TP-Link Systems Inc., accusing the router manufacturer of misleading consumers about its products’ security and concealing continuing operational ties to China.
According to the complaint by Uthmeier, TP-Link promoted its HomeShield service as covering “all security scenarios” and addressing threats including information leaks, computer viruses, and attacks against internet-connected devices. A version of the company’s website also advertised a “100% safeguard” for network security as recently as November 2025, according to records cited in the complaint.
Those assurances were misleading because several TP-Link routers contained critical vulnerabilities that hackers exploited, according to the lawsuit. The complaint alleges Chinese state-sponsored groups used compromised TP-Link routers in the Volt Typhoon and Flax Typhoon campaigns, while another Chinese threat actor used a network made up predominantly of compromised TP-Link routers to steal login credentials.
Russian military intelligence also exploited a vulnerability affecting TP-Link’s TL-WR940N router. The lawsuit alleges the attacks could allow Russian operatives to intercept communications that users believed were encrypted.
Some affected models did not support automatic firmware updates, leaving consumers responsible for finding and manually installing security patches. TP-Link also stopped providing updates for certain models after declaring them at the end of their service life, even though the devices may remain in Florida homes and businesses.
The lawsuit also challenges TP-Link’s representations that it separated from its Chinese operations in 2024. TP-Link has said it has different ownership, management and operations from China-based TP-Link Technologies Co. Ltd., and that no foreign or domestic government controls the design or production of its devices.
Much of the company’s research, development, and manufacturing, nevertheless, remains in China, according to the state’s allegations. The U.S. Department of Defense designated TP-Link Technologies as a Chinese military company in June, according to federal records cited in the lawsuit.
TP-Link has also said it manufactures routers for the U.S. market at its own factory in Vietnam. However, just 0.5 percent of the components used at that factory, measured by value, are purchased in Vietnam, while the remaining inputs are imported from or through China.
TP-Link’s Response
TP-Link Systems’ corporate affairs officer Steve Kovsky said in an Oct. 6 statement that the four lawsuits “are built on false premises.”
“TP-Link Systems is a U.S. company that complies with U.S. privacy and data protection laws. We meet or exceed all industry best practices for monitoring and preventing vulnerabilities and … do not share customer network data with foreign governments or unauthorized third parties.”
The state is seeking a permanent injunction, consumer relief, repayment of allegedly improper gains, and civil penalties. Florida is seeking penalties of up to $10,000 for each willful violation and up to $15,000 for violations involving seniors, people with disabilities, service members, their families, or veterans.
“We will not allow families to be misled into handing their personal data to the Chinese Communist Party,” Uthmeier said.
TP-Link has been contacted for comment.
