Florida, Montana, Iowa and Nebraska are suing router maker TP-Link over security

Attorneys general in four states sued TP-Link Systems on Tuesday, Oct. 6, 2026: Florida’s James Uthmeier, Montana’s Austin Knudsen, Iowa’s Brenna Bird and Nebraska’s Mike Hilgers. Each complaint accuses the California-incorporated router maker of telling customers its products are secure and cleanly separated from China, claims the states say do not survive scrutiny.

The defendant is not a niche brand. Montana’s complaint alleges TP-Link controls at least 60 percent of the U.S. retail market for Wi-Fi systems and small-office and home-office routers, which is why four state capitals chose the same week to go after it. TP-Link corporate affairs officer Steve Kovsky answered that the suits are “built on false premises” and that the company looks forward to “refuting these baseless allegations in court.”

Four complaints under four consumer-protection laws

Montana’s case was filed in Lewis and Clark County under the Montana Consumer Protection Act. Knudsen’s office alleges false security representations, misstatements about corporate separation and manufacturing, omissions about data practices and unfair acts, and asks for a permanent injunction plus civil penalties of $10,000 per violation. “Millions of Americans have unknowingly invited a foreign adversary into their living rooms,” Knudsen said.

Iowa’s petition, announced in Des Moines, rests on the Iowa Consumer Fraud Act. Bird’s office says TP-Link markets its routers as secure and made in Vietnam while much of its research, development and manufacturing remains in China, nearly all parts come from or through China, and the firmware gives the Chinese government access to users’ devices and data. “It’s time to hold China and China-backed companies accountable,” she said.

Nebraska’s complaint invokes the state Consumer Act and the Uniform Deceptive Trade Practices Act. Hilgers is seeking civil penalties, fees and an order stopping the alleged misstatements, and said the case involves “a company misleading Nebraskans about their connection to the Chinese Communist Party.”

Florida announced its suit through a video on X. Uthmeier said TP-Link was sued for “lying about the safety of its routers and its ties to the CCP,” as Tom’s Hardware reported. The case follows a December 2, 2025 investigative subpoena in which his office said misleading consumers about foreign-government access would violate the Florida Deceptive and Unfair Trade Practices Act.

The Vietnam factory and the May 2024 split

The center of every complaint is TP-Link’s account of itself. The company says it separated in May 2024 from TP-Link Technologies Co., Ltd. in China and that products sold in the United States are made in Vietnam. Montana’s filing counters that, citing Bloomberg reporting, about 11,000 employees remain in China, where research, development and manufacturing take place, against roughly 300 in the United States.

On the parts question the states differ slightly in wording. Montana says under 1 percent of components by value come from Vietnam, with the remainder imported from or through China. Uthmeier put it as “less than 1% of the parts in that Vietnam plant actually come from Vietnam.” Reports on the suits describe one citation of half of one percent by value, a gap that will matter if a court asks which figure the evidence supports.

Router models named in the filings

Security is the second pillar. Montana’s release says the routers had firmware vulnerabilities that were actively exploited in the Volt Typhoon and Flax Typhoon intrusions, drawing on congressional testimony, and that Russian military intelligence also exploited them. It points to TP-Link’s HomeShield marketing and earlier “100% safeguard” claims as misleading given those flaws.

Reports on the complaints list specific hardware. Nebraska’s suit says the TL-WR940N was sold through 2024, and the FBI warned in April that Russia’s military intelligence had found an exploit in that model. Two versions of the Archer C7 were allegedly hijacked by a network known as Quad7, and the Archer AX21, advertised in 2022 as offering “refined password security,” carried a flaw disclosed in 2023 that Flax Typhoon is said to have used to take control without a password. Uthmeier added that “many of those models cannot even update themselves automatically, and TP-Link has stopped supporting them.”

A federal record the states build on

None of the four suits arrives without federal groundwork. Montana’s release recalls that the Commerce, Defense and Justice departments opened investigations in 2024, that federal officials were weighing a sales ban over an “unacceptable risk,” and that the Defense Department this summer identified TP-Link Technologies as a Chinese military company. Cord Cutters News noted that earlier in 2026 the FCC barred new consumer routers made abroad, with exemptions for Netgear, Asus, Nokia and Starlink that TP-Link did not receive.

Hilgers framed the remedy in blunt terms, saying Nebraska would welcome TP-Link pulling the older routers from shelves but wants buyers warned at a minimum, because “some of these older routers can be easily exploited by other foreign intelligence agencies.”

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

More from Morning Overview