Reports on Midea and labour, data and device security

analysisA joint media investigation published on 29 May 2025 reported that, for the first time, evidence showed factories directly owned by big brands, such as those run by Midea and LG Electronics, had taken part in a Chinese government programme that moves workers from Xinjiang to factories elsewhere in China, a system that, in the publication's description, international authorities call forced labour. It also reported that a worker from Xinjiang had posted a video from a plastics factory that, according to the publication, has supplied Midea. These are the publication's findings, based on geolocated social media videos and Chinese state media reports; the retained text does not name the Midea plants or the plastics factory, and no regulator or court finding concerning Midea is in the record. The publication stated that Midea did not respond to several of its requests for comment. ¹

analysisA follow-up article of the same investigation, published on 20 June 2025, stated that it had uncovered evidence of forced labour at plants owned by Hisense, Midea, Haier and TCL, in the sense of plants receiving workers through the Xinjiang labour-transfer programme; the retained text does not identify the Midea plants or the number of workers, and no regulator or court finding concerning Midea is in the record. The article stated that Midea, Haier, TCL and De'Longhi did not respond to requests for comment. It also described Wuhan Honghai Technology as a supplier to Haier, Midea and TPV that listed on the Beijing Stock Exchange in February 2025, and reported that, a few months before the listing, one of the Xinjiang workers at its factory had posted a video from the onsite dormitory. The supplier relationship and the presence of Xinjiang workers are the publication's statements, and no other retained source covers Wuhan Honghai's dealings with Midea. The article stated that Wuhan Honghai did not respond to requests for comment. ²

analysisA technology news report of 1 September 2022 stated that the REvil ransomware group had claimed an attack on Midea Group and said it had stolen data including blueprints and firmware source from the company's product lifecycle management system, financial information that it was ready to sell, and source code from version control systems. According to the report, screenshots posted by the group suggested that multiple terabytes had been taken, and the group had already published files said to come from Midea Group, including scans of identity documents, alleged screenshots of the company's VMware vSphere client, compressed archives and an SSH key. These are claims by a ransomware group: the report stated that Midea Group had not officially confirmed the legitimacy of the attack and that its web pages and social media accounts appeared unaffected at the time of writing. The report said it had approached Midea Group for comment and records no reply. ¹

analysisTwo other leak-site claims name 'Midea Carrier' rather than Midea Group: a ransomware-tracking site lists it as a victim claimed by the Conti group on 1 April 2022, and a data-breach monitoring site reports that the Akira group posted it on its leak site on 4 December 2023, claiming to have exfiltrated internal files and announcing the release of 40 GB of data. Neither claim has been verified: the Conti listing does not identify which Midea Carrier entity or country is meant or what data were involved, the monitoring site quotes the Akira group's own claim, and the record contains no confirmation of an intrusion or a data release and no statement from the company. ^{2 3}

analysisA German IT publication reported in August 2026 that Midea PortaSplit mobile air conditioners could be controlled by anyone within Bluetooth range, a radius of a few metres, independently of the manufacturer's app, the pairing status and the device PIN, through an OEM (original equipment manufacturer) software interface whose AES encryption keys can be calculated from information the devices broadcast. The publication said that an anonymous whistleblower had found the method, that its editors reproduced it on a test device, and that remote access via the internet or Midea's cloud was not possible; no independent technical assessment or regulator finding is in the record. According to the publication, Midea's German press department first stated that a scenario in which an unauthorised person takes over or resets a PortaSplit remotely could not be reproduced, because physical access is required to reset the device and bypass the user PIN. After publication, Midea stated that its technical teams were working on an over-the-air (OTA) firmware update to resolve the reported issue, which was in validation and testing and would be deployed once that process was completed. ¹

analysisA media report of 10 September 2026 stated that a user had claimed on a short-video platform that a Midea washing machine connected to Wi-Fi had generated more than 400 MB of data traffic in 19 hours and 40 minutes, raising privacy concerns; the figure is the user's claim as reported, and no technical test or regulator finding is in the record. The same day Hefei Midea Washing Machine Co., Ltd. stated on its official microblog account that a technical check had found no large-scale data transmission by Midea smart washing machines: a wash cycle transmits only 100 KB to 200 KB, limited to remote-control commands, wash-status synchronisation and other information needed for core functions; no personal information of users is collected or uploaded; and all transmissions are encrypted in compliance with China's Cybersecurity Law and Personal Information Protection Law. Midea customer service told a reporter that connecting appliances to the network is not mandatory and that remote control of connected devices can be switched off. ¹

analysisMidea's own figures describe the scale of its connected devices. Its 2025 annual results announcement states that more than 140 million Midea smart home appliances and more than 150 million smart users were connected globally, in a passage citing a market research firm's ranking of Midea first in global smart appliance sales in 2025; that by the end of 2025 the Midea Home app had more than 88 million registered users in China and more than 21 million monthly active users; and that in 2025 cumulative overseas registered users of Midea's smart home applications exceeded 11 million, with average monthly active users up more than 60% year on year. It adds that Midea's cloud-based call centre system, introduced in 2022, operated in 22 countries and regions and relied on Amazon cloud security tools to meet overseas data compliance requirements. The 2026 interim report repeats the figures of more than 140 million connected appliances and more than 150 million smart users. These figures describe the volume of connected devices and app users, not any data incident. ^{1 2}

analysisMidea America Corp.'s U.S. privacy policy, last modified on 2 June 2025, states that the company shares consumers' personal information, as 'share' is defined under the California Consumer Privacy Act (CCPA), in the context of cross-context behavioural advertising, and sells it, as 'sell' is defined under the CCPA, in the context of third-party product or service offerings, and that consumers may opt out through a 'Do Not Sell or Share My Personal Information' link on the homepage; these are the company's own disclosures using the CCPA definitions, not a finding by any authority. The policy also states that its services are not intended for children under 18, that no one under 18 may provide information to or on the services and that the company does not knowingly collect personal information from children under 18, and that it does not apply to information collected by third parties, including Midea America Corp.'s affiliates and subsidiaries, through linked applications or content. ³

analysisThe privacy notice on Midea's UK website, last modified in July 2021, which names Midea Home Appliances UK Ltd. as controller, states that the site uses Google Analytics with consent as the legal basis, that information generated by its cookies is usually transferred to and stored on a Google server in the United States, that personal data will be transferred to the US under the EU-US Privacy Shield on the basis of the European Commission's adequacy decision, and that data linked to cookies or user identifiers are automatically deleted after 14 months. It also states that the site uses the Custom Audiences service of Facebook Inc. through a Facebook pixel: a non-reversible hash value generated from usage data is transmitted to Facebook for analysis and marketing, a Facebook cookie collects information about activities on the website such as surfing behaviour and subpages visited, and the IP address is stored and used for the geographic targeting of advertising. This is the notice's own wording as captured in the record, which contains no regulator's assessment of it. ⁴