Midea Group — Midea: connected-device findings and labour allegations

analysisA technical investigation reported that nearby users could control a PortaSplit air conditioner over Bluetooth despite the ordinary app’s pairing protections. The reporters described reproducing the behaviour on a test device. The reported exposure was within Bluetooth range, not remote access over the internet. This account describes the tested behaviour and its limits; it is not evidence that all Midea cloud services or customer accounts were compromised. Midea initially said it could not reproduce an unauthorised takeover or reset. After further explanation it said an over-the-air firmware update was undergoing validation and testing. The retained report establishes an announced fix in preparation, not verified deployment or successful remediation. ¹

analysisA September 2026 report recounts a user’s claim that a connected Midea washing machine transmitted more than 400 MB in about 20 hours, prompting privacy concerns. The user’s traffic observation does not itself prove transmission of personal data or a corporate breach. Hefei Midea Washing Machine said its technical check found no such large-scale transmission. It described 100–200 KB per wash cycle for remote-control commands and status synchronization, denied personal-information collection or upload and said transmissions were encrypted. These are the company’s statements, not an independent technical verification. The retained report does not establish a regulator’s finding or a completed independent reconciliation of the user and company accounts. ²

analysisA 2025 joint investigation attributed participation in Xinjiang labour-transfer programmes to factories directly owned by Midea and described the programme as involving forced labour. Its reporting combined geolocated social-media material with government and other records. The retained passages do not identify the particular Midea legal factory entities. Allegations about other brands’ factories must not be assigned to Midea, and the report is not a court judgment or a sanctions designation. The investigation said Midea did not respond to its questions. Other companies’ denials are not presented as Midea’s response; this publication conducted no separate outreach. No adjudicated Midea-specific outcome is established in this packet. ^{3 4}

analysisA third-party breach tracker attributes a December 2023 Midea Carrier ransomware claim to the Akira group. A separate September 2026 check reports exposed midea.com-related credentials in external breach collections and infostealer logs. The tracker does not establish whether the accounts belonged to customers or employees, whether the corporate network was compromised, or whether the later credential collections were connected to the ransomware claim. These are attributed reports, not independent confirmation of an intrusion. No credentials, account lists or access data are reproduced. The retained page supplies no confirmed incident-resolution outcome or company response; absence from this page is not evidence that no response exists. ⁵