Alyssa LeMay knew someone was watching her because the blue light from the Ring camera perched in her bedroom was blinking. She'd wandered in moments earlier, lured by eerie music and strange sounds. Then a strange man said, "Hello there."
The 8-year-old gasped and jerked her head, trying to figure out where the voice was coming from. Confused, she picked up her toys, putting them to her ear, and walked back across the carpet, scanning the large room she shares with her two other sisters.
Moments later, the man started screaming a racial slur at her over and over until Alyssa responded by screaming, "What? I can't hear you!"
On the night of Dec. 4, a stranger hacked into the LeMay family's Ring security system and watched them move around their home in Nesbit, Mississippi. For nearly 10 minutes, he interacted with Alyssa. He could see her, talk to her, and had access to a second system placed in her baby sister's room downstairs.
Thinking it was her younger sister playing music, the third-grader wandered upstairs to her room as the eerie song, “Tiptoe Through the Tulips," blared from the Ring camera. The man proceeded to tell her to go call her "mommy" the n-word and demand that she repeat it back to him: "Come on, girl, say it with me."
"Mom?" Alyssa asked, confused. "Who is that?
"I'm your best friend," the replied. "You can do whatever you want right now. You can mess up your room; you can break your TV. You can do whatever you want."
Terrified, the little girl yelled at the empty room again, asking, "Who is that?"
"I'm your best friend," he repeated. "Santa Claus."
The little girl then left her room, telling the camera, "I don’t know who you are."
Ashley LeMay, Alyssa's mom, called that night "her worst nightmare." The mother of four wants to know how hackers were able to breach the Amazon-owned product and compromise their privacy, a question other families have also been asking.
Over the past few weeks, several Ring customers across the country have detailed their own terrifying hacking experiences, publishing grainy videos showing strange voices coming across their systems.
On Sunday, someone broke into the Brown family's Ring camera in Florida and started making racist comments about their son, calling him a "baboon," NBC 2 reported. The 15-year-old wasn't in the room, making his parents think that the man had been watching them for longer than those few minutes.
There's even an entire podcast dedicated to hackers taking over people's smarthome cameras and harassing them, which Vice investigated.
The worst part about enduring this hacking, LeMay said, was that they were unable to protect their kids from intruders, despite her husband being in their own home.
"I was down the street when my husband messaged me, asking if I had been messing with the girls with the Ring," the 27-year-old told BuzzFeed News on Friday. "I started watching the video on my phone and when I heard his voice and realized it was not my husband's voice my heart just dropped and I ran back to the house."
After watching the entire recording that night, she immediately called Ring and told the company what had happened. The next day, her family left on a preplanned cruise. On Dec. 6, she said Ring emailed her and her husband and informed them the company had detected "unusual activity" on their account. But after that, she said, she didn't hear anything.
"I'm shocked at Ring's response," LeMay said. "I thought I would have 16 voicemails from them when I got home because it's become such a big deal and it was such a creepy video. I was frustrated they hadn't given me an update."
On Dec. 9, LeMay said she finally was able to speak with a Ring employee, who assured her that her account had not been hacked and said it was a "data breach from a third party." The representative was unable to tell her if the hacker was local and what information he might have, she said, and instead asked her about her passwords and why she didn't have two-factor authentication for protection.
"I asked if at some point they would be able to tell me if this was a targeted attack or who was interacting with my daughter, and he couldn't provide a straight answer," she said. "Then today we talked with the COO, and he told us that our Ring account had been hacked. I'm so frustrated."
In a statement to BuzzFeed News, Ring said that its security team had investigated the incident and found "no evidence of an unauthorized intrusion or compromise of Ring’s systems or network."
"Recently, we were made aware of an incident where malicious actors obtained some Ring users’ account credentials (e.g., username and password) from a separate, external, non-Ring service and reused them to log in to some Ring accounts," a company spokesperson said. "Unfortunately, when the same username and password is reused on multiple services, it’s possible for bad actors to gain access to many accounts."
After learning about the incident, Ring said it took "appropriate actions to promptly block bad actors" and contacted affected users.
"Customer trust is important to us and we take the security of our devices seriously," the company said.
LeMay, though, said she and her husband experienced the opposite.
They have no idea who had been watching and talking to their daughter, if those strangers now know her home address, how much recorded footage they saw after breaking into her account, and if they have done anything with it.
"Tons of thoughts have gone through my head," she said. "I don't feel it was a coincidence that I have four girls and they were trying to gain their trust, telling her she could do whatever she wanted."
It's beyond upsetting to know that a "creepy man" had unfettered access into their private lives.
"The video they could have watched right before they livestreamed was my 2-year-old going upstairs and changing her pants and I don't know who saw that," she added.
The mother also can't help but feel "dumb" for installing the indoor Wi-Fi cameras but had heard good things about them from her friends and neighbors. LeMay works nights as a medical research scientist, and she wanted to be able to watch her girls as they slept and be there in case they needed her.
"My 4-year-old has a medical condition. She has a history of seizures and I can't be there all the time," she said. "I got them so when I am at work and my baby got up I could tell her, 'Hey, I love you, go back to sleep,' and she wouldn't know I wasn't there."
Her daughter is still in shock and wants to know who was speaking to her and why he kept calling her "a bad word." She and her sisters refuse to sleep in their beds.
"She told me yesterday that it's hard for her to remember the camera's not there," LeMay said. "She doesn't want to be in that room. It's really alarming to her that we can't tell her who it was."