Zoom Security Incidents and Privacy Issues: A Timeline From 2019 to 2026

We count about fifteen notable Zoom security and privacy incidents since 2019, and most of them landed in 2020, when Zoom's user base exploded during the pandemic. The most serious were the misleading "end-to-end encryption" claims that ended in an FTC order, and a China-based employee who, by Zoom's own account, helped shut down Tiananmen commemorations and shared limited user data with Chinese authorities. There is no public report of attackers breaching Zoom's servers and stealing meeting recordings or chat content, but Zoombombing exposed live meetings to intruders, and the FTC says some cloud recordings sat unencrypted for up to 60 days.

Zoom Security and Privacy Incidents: Timeline

The table lists incidents in order. "Vulnerability" means a bug that was reported and fixed, with no confirmed exploitation unless stated. The timeline is current as of 7 November 2026.

Sources: Zoom's blog and security bulletins, the FTC, Citizen Lab, the US Department of Justice, SEC filings and the reporting listed under Sources & References.

2019: The Mac Web Server That Could Turn On Your Camera

In July 2019 security researcher Jonathan Leitschuh disclosed that the Zoom Mac client installed a hidden web server on the user's computer, listening on localhost. Any website could talk to it, so a malicious page could drop a visitor into a Zoom call with their camera on (CVE-2019-13450). Worse, the server stayed behind after you deleted Zoom, and could reinstall the app when you visited a web page.

Leitschuh reported the camera issue to Zoom on 26 March 2019 and went public in July, saying Zoom's fix only partly addressed it. Zoom initially downplayed the risk, then removed the web server in a July 2019 update. Apple also pushed a silent macOS update to remove the server from Macs. The FTC later alleged that Zoom installed the server in a July 2018 update that bypassed a Safari safeguard, without adequately telling users.

2020: Zoombombing and Weak Meeting Defaults

As schools and offices moved to Zoom in March 2020, uninvited people began joining meetings and classes to shout, share pornography or post hate symbols. On 30 March 2020 the FBI's Boston office warned of "Zoom-bombing", describing a Massachusetts high school class joined by an unidentified person and another meeting where an intruder displayed swastika tattoos.

This was not a hack of Zoom's servers. Meeting links were often posted publicly or shared widely, and passwords and waiting rooms were not on by default for every account. Zoom turned on passcodes and waiting rooms by default during its 90-day security push, and the FBI's advice (private meetings, passcodes or waiting rooms, links never posted publicly) still holds.

2020: The "End-to-End" Claim and Citizen Lab's Findings

For years Zoom's marketing and security white paper said meetings were protected with "end-to-end, 256-bit encryption". On 1 April 2020 Zoom acknowledged on its blog that it did not offer end-to-end encryption as most people understand the term; Zoom's servers held the keys. The same day CEO Eric Yuan apologised, saying Zoom had fallen short of its users' and its own privacy and security expectations, and froze new features for 90 days to move engineers onto trust, safety and privacy work.

Two days later, on 3 April 2020, Citizen Lab researchers Bill Marczak and John Scott-Railton published a review of Zoom's meeting encryption. They found:

• Each meeting used a single AES-128 key in ECB mode, shared by all participants, not AES-256 as Zoom's documentation said. ECB preserves patterns in the plaintext and is not recommended.
• The keys were generated by Zoom's servers, and in a test call between the US and Canada the key was sent from a server that appeared to be in Beijing.
• A separate flaw in the Waiting Room feature, which they withheld until Zoom fixed it.

Zoom said some calls had been routed through China by mistake while it added capacity, and promised geofencing so keys would not pass through China for users outside it. Zoom 5.0, released in April 2020, added AES-256-GCM, and Zoom made it mandatory for all meetings on 30 May 2020. In May 2020 Zoom bought Keybase to build real end-to-end encryption, which it launched as an opt-in mode in late 2020. Our post Is Zoom end-to-end encrypted? explains how that mode works today and what it switches off.

2020: iOS App Sent Data to Facebook

On 26 March 2020 Motherboard reported that Zoom's iOS app sent data to Facebook when it opened, through the "Login with Facebook" SDK, even for people without a Facebook account. The data included device model, time zone and city, phone carrier and a unique advertising identifier, and Zoom's privacy policy didn't mention it. Zoom said the SDK was collecting unnecessary device data, and removed it in an update the next day, moving Facebook login to the browser. The data sharing later formed part of the US privacy class action described below.

2020: 500,000 Zoom Logins for Sale (Credential Stuffing)

In April 2020 BleepingComputer reported that more than 500,000 Zoom account logins were being sold on hacker forums, some for a fraction of a cent and some given away. Threat intelligence firm Cyble bought about 530,000 of them, each with an email address, password, personal meeting URL and host key.

This was not a breach of Zoom. The logins came from credential stuffing: attackers took email and password pairs leaked from other sites' breaches and tried them against Zoom, keeping the ones that worked. Zoom said it had hired intelligence firms to find the password dumps and was locking compromised accounts, and that the attack generally did not affect enterprise customers using their own single sign-on. Anyone who reused a password from another site was exposed; anyone with a unique password or two-step verification was not.

2020: Tiananmen Meetings and an Insider Working for Chinese Authorities

In June 2020 activists in the US and Hong Kong found their Zoom accounts suspended after hosting online commemorations of the 1989 Tiananmen Square crackdown. Zoom then said the Chinese government had told it about four planned meetings, called them illegal in China and demanded they be ended. Zoom ended three, suspended or terminated the host accounts, and later reinstated them. It said it "did not provide any user information or meeting content to the Chinese government", and promised tools to remove participants by country instead of shutting down whole meetings.

On 18 December 2020 the US Department of Justice charged Xinjiang "Julien" Jin, a China-based Zoom employee who served as the company's contact with Chinese authorities, with conspiracy to commit interstate harassment and unlawful conspiracy to transfer a means of identification. Prosecutors allege he helped disrupt meetings commemorating Tiananmen in May and June 2020 and fabricated evidence of terms-of-service violations to justify ending them. These are allegations; Jin is in China and not in US custody. In April 2023 an amended complaint added Chinese government officials as defendants.

Zoom's own post the same day went further than its June statement. Its internal investigation found that the employee had tried to get around internal access controls and that, apart from data on "fewer than ten individual users", it did not believe he or other employees shared data on users outside China with Chinese authorities. Zoom fired him, put other employees on leave, cut China-based staff's access to its global production network, tightened internal access controls and required US legal approval for government requests.

FTC Order and Settlements: 2020 to 2023

FTC settlement (November 2020)

On 9 November 2020 the FTC announced a settlement with Zoom. According to the FTC, since at least 2016 Zoom had claimed "end-to-end, 256-bit encryption" while holding keys that could let it access meeting content and using a lower level of encryption than promised. The FTC also said Zoom told users cloud recordings were encrypted right after a meeting ended, when some were stored unencrypted on its servers for up to 60 days, and it covered the Mac web server.

The order requires a comprehensive information security program, an annual risk assessment, a vulnerability management program, safeguards such as multi-factor authentication, steps to block known compromised credentials, security review of software updates, independent assessments every two years, and notice to the FTC of data breaches. It bars Zoom from misrepresenting its privacy and security practices. Zoom paid no fine and did not admit wrongdoing. The FTC gave final approval in early 2021 on a 3-2 vote. In dissent, Commissioner Rebecca Kelly Slaughter argued the order gave affected users no recourse and did not address Zoom's privacy failings.

$85 million privacy class action (2021)

In July 2021 Zoom agreed to pay $85 million to settle a US class action alleging it shared users' personal data with Facebook, Google and LinkedIn and let Zoombombing happen. Paying subscribers could claim 15% of what they paid or $25, whichever was more; other users $15. Zoom also agreed to privacy and security changes and denied wrongdoing. US Magistrate Judge Laurel Beeler in San Francisco gave final approval in April 2022.

$150 million securities settlement (2023)

In a July 2023 SEC filing Zoom disclosed a $150 million agreement, paid by Zoom and its insurers, to settle a shareholder class action alleging the company misled investors about its privacy and security between April 2019 and April 2020. The settlement includes no admission of wrongdoing.

Zero-Click Bugs: Pwn2Own 2021 and Project Zero 2022

A zero-click bug is one an attacker can exploit without the victim clicking anything. Zoom has had two notable ones, both found by researchers and fixed before any known use in attacks.

At Pwn2Own in April 2021, Daan Keuper and Thijs Alkemade of Computest chained three bugs to run code on a target's Windows or Mac computer through Zoom Chat, with no action from the victim, and won $200,000. Zoom said it shipped a server-side fix on 9 April 2021, that the attack needed the victim to have accepted the attacker as a contact or to be in the same account, and that in-meeting chat was not affected.

In May 2022 Ivan Fratric of Google Project Zero published what he called "XMPP stanza smuggling". Zoom's client and server parsed chat messages differently, so an attacker who could send someone a Zoom Chat message could smuggle in control messages, point the victim's client at a malicious server, and push a downgraded update to run code. Zoom fixed the server side in February 2022 and the clients in version 5.10.0. The bugs are CVE-2022-22784 (CVSS 8.1), CVE-2022-22785, CVE-2022-22786 (Windows only) and CVE-2022-22787. There were no reports of exploitation.

2023: The AI Training Terms Controversy

In March 2023 Zoom updated its terms of service. In August 2023 people noticed clauses that gave Zoom consent to use "Service Generated Data" for machine learning and AI training, and a license to use "Customer Content" for "machine learning, artificial intelligence, training, testing". The backlash was fast, and some open source groups urged developers to leave Zoom.

On 7 August 2023 Zoom's chief product officer Smita Hashim wrote that Zoom would not use audio, video or chat content to train its models without consent. Critics pointed out that consent could be given by an account admin, not each participant. On 11 August Zoom rewrote the terms again, removing the AI training language and adding that it does not use audio, video, chat, screen sharing, attachments or other communications-like content to train Zoom's or third-party AI models. There is no report that Zoom trained models on meeting content; the incident was about what the contract allowed. We cover the wider pattern in AI and your chats: are apps training models on your messages?

2025: Attackers Abusing Zoom's Remote Control

In April 2025 Trail of Bits described a campaign by a group it calls ELUSIVE COMET, which it links to large cryptocurrency thefts. Attackers posing as Bloomberg Crypto producers invited targets to Zoom interviews, then requested remote control of the victim's screen while renaming themselves "Zoom", so the request looked like a system prompt. Anyone who approved gave the attacker control of their computer to install malware or steal funds. Trail of Bits' own CEO was targeted and spotted it.

This isn't a bug. Remote control is a documented feature that needs the victim's approval, which is why Trail of Bits recommends turning it off, or blocking the accessibility permission it needs on macOS, in high-risk environments.

2025 and 2026: Critical Patches and an Outage

Zoom publishes security bulletins for every fix, and several recent ones are rated critical:

• August 2025, CVE-2025-49457 (CVSS 9.6): an untrusted search path in some Zoom clients for Windows could let an unauthenticated user escalate privileges over the network.
• January 2026, CVE-2026-22844 (CVSS 9.9): command injection in the Multimedia Router of Zoom Node (Meetings Hybrid and Meeting Connector) before version 5.2.1716.0 could let a meeting participant run code on the router. This affects organisations that host Zoom Node on their own infrastructure. Zoom's Offensive Security team found it.
• March 2026, CVE-2026-30903 (CVSS 9.6): the Mail feature in Zoom Workplace for Windows before 6.6.0 could let an unauthenticated user escalate privileges over the network.
• July 2026, CVE-2026-53412 (CVSS 9.8): improper input validation in Zoom Workplace for Windows before 7.0.0, and the VDI client before 7.0.10, 6.6.15 and 6.5.18, could let an unauthenticated attacker take over an account over the network. Zoom's Offensive Security team found it.

None of these bulletins says the flaw was exploited. Separately, on 16 April 2025 zoom.us went offline for about 1 hour 47 minutes after GoDaddy Registry placed a block on the domain following a miscommunication with Zoom's registrar, MarkMonitor. Despite claims online, GoDaddy Registry said there was "no product, security or network failure" at any of the three companies.

What the Incidents Have in Common

Looking across seven years, a few patterns stand out:

• Convenience over safety by default. The Mac web server, guessable meeting IDs and optional passcodes all removed friction at the cost of security. Zoombombing ended mostly because Zoom changed defaults.
• Claims ahead of reality. Zoom described its encryption as end-to-end while its servers held the keys. The FTC order, the $85 million and $150 million settlements all trace back to what Zoom said versus what it did.
• The server holds the keys. Citizen Lab's China finding mattered because keys were made and handed out by Zoom's servers, so where those servers sit, and who can reach them, decides who could read a meeting.
• Insiders and governments. The Tiananmen case was not an outside hack; an employee with privileged access acted for a government.
• People, not code. Credential stuffing and the remote-control attacks needed no Zoom bug, just reused passwords or a click on "Approve".

End-to-end encryption, where only participants hold the keys, would have limited some of these. It would have made the China key routing and the unencrypted cloud recordings far less important, because Zoom's servers couldn't read the media. It would also have made it harder for an insider to see meeting content, though not to see who met, when, or to shut meetings down. It would not have stopped Zoombombing (an intruder in the meeting gets the key like everyone else), credential stuffing, remote-control social engineering, a malicious client update, or data sent from the app to Facebook. It also does nothing for metadata, which Zoom says it still sees in end-to-end encrypted meetings.

How to Reduce Your Risk on Zoom

Most of these steps come from Zoom's own documentation and the FBI and Trail of Bits guidance above:

1. Keep Zoom updated. The recent critical bugs are fixed in current versions. Admins should check Zoom's security bulletins and push updates to desktop, VDI and Zoom Node deployments.
2. Lock down meetings. Keep passcodes and waiting rooms on, allow only authenticated users where you can, and never post meeting links publicly.
3. Turn on two-step verification or SSO. Admins can require it under Security settings in the Admin Center; use a unique password either way, so credential stuffing fails.
4. Disable remote control if you don't need it. Admins can switch it off account-wide in meeting settings. Never approve a remote control request you didn't expect, even if it appears to come from "Zoom".
5. Use end-to-end encryption for sensitive meetings. It's opt-in and turns off cloud recording, transcripts and AI features, which is the point for confidential calls.
6. Review AI and recording settings. Decide who can turn on AI Companion, cloud recording and transcripts, and require authentication to view recordings.

If you think an account or meeting has been compromised, see our first 24 hours after a data breach checklist, and for rolling out two-step verification across a team, our two-factor authentication guide.

Frequently Asked Questions

Final Takeaway

Zoom's record is mostly a 2020 story: a product built for ease of use met hundreds of millions of new users, and its encryption claims, defaults and China operations didn't hold up. Zoom fixed much of that, and its recent incidents are patched bugs and social engineering rather than breaches. The lasting lesson is that when the provider holds the keys, your privacy depends on its staff, its servers and its promises.

That is why we built Lupyd with end-to-end encrypted messaging by default: DMs use the Signal Protocol, group channels use MLS, and files and backups are encrypted on your device. To be clear about our limits: our group calls run through Cloudflare and are not yet end-to-end encrypted, we haven't had an external security audit yet, and encryption doesn't stop phishing, stolen devices or metadata exposure. Try Lupyd.

Sources & References

• CVE-2019-13450, CVE record, published 9 July 2019
• Zoom Zero-Day Bug Opens Mac Users to Webcam Hijacking, Threatpost, 9 July 2019
• Zoom iOS App Sends Data to Facebook Even if You Don't Have a Facebook Account, Motherboard (Vice), 26 March 2020
• Zoom iOS app removes Facebook code, 9to5Mac, 27 March 2020
• FBI Warns of Teleconferencing and Online Classroom Hijacking During COVID-19 Pandemic, FBI Boston, 30 March 2020 (republished by Mondaq)
• Move Fast and Roll Your Own Crypto: A Quick Look at the Confidentiality of Zoom Meetings, Citizen Lab, 3 April 2020
• Zoom freezes feature development to fix security and privacy issues, TechCrunch, April 2020
• Zoom Hits Milestone on 90-Day Security Plan, Releases Zoom 5.0, Zoom Blog, 22 April 2020
• CEO Report: 90 Days Done, What's Next for Zoom, Zoom Blog, 1 July 2020
• Over 500,000 Zoom accounts sold on hacker forums, the dark web, BleepingComputer, 13 April 2020
• Zoom suspends US-based activist's account after Tiananmen Square commemoration event, CNBC, 11 June 2020
• Zoom says it acted on Tiananmen accounts after China demand, Al Jazeera, 12 June 2020
• China-Based Executive at U.S. Telecommunications Company Charged with Disrupting Video Meetings Commemorating Tiananmen Square Massacre, US Department of Justice, 18 December 2020
• Eight Chinese Government Officials Charged with Directing Employee of U.S. Telecommunications Company, US Attorney's Office, EDNY, April 2023
• Our Perspective on the DOJ Complaint, Zoom Blog, 18 December 2020
• FTC Requires Zoom to Enhance its Security Practices as Part of Settlement, FTC, 9 November 2020
• FTC Gives Final Approval to Settlement with Zoom, FTC, February 2021
• Zoom reaches $85 million settlement over user privacy and hacker 'Zoombombing', CNBC, 1 August 2021
• Federal Judge Approves $85 Million Settlement in Zoom Case, Insurance Journal, 2 May 2022
• Zoom Video Communications Form 8-K (securities class action settlement), SEC, July 2023
• Pwn2Own 2021 hacking contest ends with a three-way tie, The Record, April 2021
• Zoom zero-day discovery makes calls safer, hackers $200,000 richer, Malwarebytes, April 2021
• Zoom RCE from Pwn2Own 2021, Computest Sector 7, August 2021
• Zoom: XMPP stanza smuggling, Google Project Zero issue tracker
• Google Discloses Details of Zoom Zero-Click Remote Code Execution Exploit, SecurityWeek, 25 May 2022
• CVE-2022-22784 and CVE-2022-22787, CVE records, 18 May 2022
• Zoom knots itself a legal tangle over use of customer data for training AI models, TechCrunch, 8 August 2023
• Zoom AI tools trained using some customer data, updated terms say, CNBC, 7 August 2023
• Can Zoom use your meetings to train AI?, Full Fact, 19 September 2023
• Open source developers urged to ditch Zoom over user data controversy, TechCrunch, 16 August 2023
• Mitigating ELUSIVE COMET Zoom remote control attacks, Trail of Bits, 17 April 2025
• zoom.us outage, GoDaddy Registry, 16 April 2025
• ZSB-25030 (CVE-2025-49457), Zoom Security Bulletin, August 2025
• ZSB-26001: Zoom Node Command Injection (CVE-2026-22844), Zoom Security Bulletin, 20 January 2026
• ZSB-26005 (CVE-2026-30903), Zoom Security Bulletin, March 2026
• ZSB-26014: Zoom Workplace for Windows, Improper Input Validation (CVE-2026-53412), Zoom Security Bulletin, 14 July 2026
• Zoom Patches Critical Windows Flaw That Could Enable Account Takeover, The Hacker News, 16 July 2026
• Managing two-step verification, Zoom Support
• Requesting or giving remote control, Zoom Support
• Allowing only authenticated users in meetings, Zoom Support

Last updated: 7 November 2026.