DJI Statement On Reported Data Security Issue
DJI is investigating the reported unauthorized access of one of DJI’s servers containing personal information submitted by our users.
As part of its commitment to customers’ data security, DJI engaged an independent cyber security firm to investigate this report and the impact of any unauthorized access to that data. Today, a hacker who obtained some of this data posted online his confidential communications with DJI employees about his attempts to claim a “bug bounty” from the DJI Security Response Center.
DJI implemented its Security Response Center to encourage independent security researchers to responsibly report potential vulnerabilities. DJI asks researchers to follow standard terms for bug bounty programs, which are designed to protect confidential data and allow time for analysis and resolution of a vulnerability before it is publicly disclosed. The hacker in question refused to agree to these terms, despite DJI’s continued attempts to negotiate with him, and threatened DJI if his terms were not met.
DJI takes data security extremely seriously, and will continue to improve its products thanks to researchers who responsibly discover and disclose issues that may affect the security of DJI user data and DJI’s products. DJI has paid thousands of dollars to almost a dozen researchers who have submitted reports to the Security Response Center and agreed to the terms for payment. As the Security Response Center receives new reports, DJI regularly agrees to pay new bounties to researchers for their discoveries.
More details about the Security Response Center and information on how to submit bugs are available on the center’s website at security.dji.com.
For additional information, please contact: pr@dji.com
