Florida joined Iowa, Montana, and Nebraska on October 6, 2026, in separate consumer-protection lawsuits against TP-Link Systems Inc. These are allegations; none have been proven in court.
Your router directs much of the traffic between household devices and the internet. Florida Attorney General James Uthmeier called it the “digital front door” to Floridians’ home networks, and on October 6, 2026, his office filed suit against TP-Link Systems Inc., accusing the company of misrepresenting both its security protections and its separation from China. The filing follows similar actions brought by Iowa, Montana, and Nebraska, and a prior Texas lawsuit that drew regulatory attention to TP-Link beginning with an investigation in 2025.
What the States Allege
The complaints share a common consumer-protection theory: TP-Link’s marketing created a false impression of strong security while omitting material information about known vulnerabilities and Chinese corporate connections.
The Nebraska complaint offers a specific example. A router advertised with “Refined Password Security” allegedly permitted attackers to gain root access without any password at all, according to the filing. That allegation has not been decided by a court.
That same filing references Volt Typhoon and Flax Typhoon, two Chinese state-linked hacking groups. The complaint alleges those groups exploited TP-Link firmware vulnerabilities in attacks against U.S. targets. These are assertions in a court filing, not judicial findings.
On the supply-chain question, the states argue that final assembly in Vietnam does not resolve the relevance of components sourced through China. The complaints also cite a June 2026 U.S. Department of Defense designation, as reported in the Nebraska filing, that labeled TP-Link Technologies, the Chinese entity the states connect to the defendant, a Chinese military company under a federal defense law known as Section 1260H of the National Defense Authorization Act. That designation is a separate federal action and does not itself resolve the lawsuit’s factual disputes.
Florida AG Uthmeier’s position, as reported by WINK News, was direct: “Today, we sued TP-Link for lying about the safety of its routers and its ties to the CCP.”
What TP-Link Says
TP-Link disputes every central allegation and says the claims will be proven false in court.
TP-Link describes itself as an independent American company. CEO Jeffrey Chao lives in Irvine, California, and the company says he has never been a CCP member. According to the company, U.S. customer data is stored on Amazon Web Services servers located in the United States.
The company’s position directly conflicts with the states’ claims about ownership, supply-chain relationships, and the significance of Chinese legal or governmental ties. Every allegation remains contested, and TP-Link has the full opportunity to challenge them in court.
What This Means for Your Network
The state complaints frame router compromise as a serious risk, though the lawsuits do not establish that any specific consumer’s data was accessed.
In some circumstances, a compromised router can allow attackers to monitor traffic, redirect connections, steal login credentials, or reach other devices on your network. That risk framing comes from the state complaints, not from any confirmed breach.
This lawsuit does not establish that every TP-Link device is compromised. It raises questions about whether the company’s security marketing accurately reflected known vulnerabilities and whether consumers received sufficient information about corporate and supply-chain relationships.
Regardless of how these cases resolve, standard network-security practices apply: update your router’s firmware, replace the default administrator password, and disable remote-management features you do not actively use. These steps reflect general network hygiene, not a concession that TP-Link devices are proven unsafe.
The cases may ultimately test how consumer-protection law applies to cybersecurity marketing claims and foreign supply-chain disclosures. Every networking manufacturer that sells on the word “secure” has reason to watch how these courts rule.
