When Alyssa LeMay heard the strange music and sounds coming from her bedroom, she walked in expecting to find one of her sisters. But the room was empty.
Then, as the 8-year-old wandered around her room alone, the mysterious song abruptly stopped.
"Hello there," a man's voice said.
It wasn't Alyssa's father, who was elsewhere inside the family's Mississippi home. The voice belonged to a stranger. And not only could the faceless man speak to the young girl - he could see her.
In a chilling exchange caught on video last week, the LeMays say the man was able to interact with their daughter after hacking into a Ring security camera that had recently been installed in the bedroom shared by Alyssa and her two younger sisters. Over the course of several minutes, the man repeatedly directed a racial slur at Alyssa and tried to persuade her to misbehave, according to a copy of the video obtained by The Washington Post.
"I can't even put into words how badly I feel and how badly my children feel," Alyssa's mother, Ashley LeMay, told The Washington Post on Thursday. "I did the exact opposite of adding another security measure. I put them at risk and there's nothing I can do to really ease their mind. I can't tell them I know who it is. I can't tell them that they're not going to show up at our house in the middle of the night."
The LeMays, however, aren't the only people who have experienced this nightmare in recent weeks. Several Ring users nationwide have reported that their security systems were also infiltrated by hackers who harassed them through the camera's two-way talk function. (Ring is an Amazon product. Amazon Chief Executive Jeff Bezos owns The Washington Post.)
A spokesperson for Ring told The Post in a statement early Thursday that what happened to the LeMays "is in no way related to a breach or compromise of Ring's security." The "bad actors" behind the attacks "often re-use credentials stolen or leaked from one service on other services," the spokesperson said. Ring has addressed the other reports of hacking with similar statements.
"Customer trust is important to us and we take the security of our devices seriously," the spokesperson said.
Trust was a major factor in Ashley LeMay's decision to buy Ring cameras for her home. For two years, the 27-year-old mother of four said she talked herself out of getting indoor security cameras, citing potential privacy breaches as one of her concerns. That changed when she saw that a majority of people in her neighborhood in a small northern Mississippi community had outfitted their homes with Ring doorbells. LeMay's friend, a fellow mother, also recommended the indoor camera to her.
"It seemed like nobody had ever had any issues with it," she said. "Everybody seemed to go with that same brand, so it seemed like something that was trustworthy."
Armed with LeMay's research, the family purchased two cameras on Black Friday. LeMay said one was installed in her infant's room and the other went on the wall in the girls' bedroom.
For LeMay, who works overnight at a hospital as a laboratory scientist, the cameras not only gave her "peace of mind" but also helped her children feel safe.
"It's really neat that you could talk to them," she said. "When I would go into work, I'd be like, 'Love you, good night.' It just made them feel like I was close."
On Dec. 4, that sense of security was shattered.
Shortly after 8 p.m., both cameras started live-streaming and the Tiny Tim cover of "Tiptoe Through the Tulips," a song that famously appeared in a scene from the 2010 horror film "Insidious," poured from the speakers, LeMay said. At the time she was out running errands while her husband was home with the children.
It was this tune that first caught Alyssa's attention, the 8-year-old told WMC.
"I thought it was my sister because I hear music. It's like, 'Tiptoe to the window,' " she said. "So I come upstairs and I hear some banging noise, I was like, 'Who is that?' "
In the video recorded by the camera, the overly cheerful song is playing as Alyssa walks into the empty bedroom. The hacker's sudden greeting prompts the girl to gasp and whip her head from side to side, frantically looking for the source.
From there, the exchange takes a dark turn.
The voice begins shouting the n-word at Alyssa, who is becoming increasingly confused.
"Go tell Mommy you're a n-----," the voice commands Alyssa, who is white.
"Who is that?" Alyssa can be heard asking.
The voice responds: "I'm your best friend. You can do whatever you want right now. You can mess up your room. You can break your TV."
The young girl repeats her question, sounding distressed. At one point, she screams, "Mommy!"
"I'm your best friend. I'm Santa Claus," the voice says, later adding, "Don't you want to be my best friend?"
The conversation ends when Alyssa says, "I don't know who you are," and walks out of the room. The camera's microphone picks up audio of Alyssa telling her father what happened.
"Someone's being weird upstairs," she says.
LeMay said her husband immediately texted her and unplugged the cameras. The worst part of watching the video was seeing her daughter call out for her, she said.
"That was the most chilling part to me," LeMay said. "She's asking for my help and there's literally nothing I could do to protect her in that moment."
Although LeMay said she contacted Ring right after the frightening incident, the family had plans to leave for a cruise the next morning, and she had to wait until they returned earlier this week to start seeking answers.
The company's responses, she said, left her frustrated. Instead of answering her questions about whether the hack was done locally or by someone far away, LeMay said, a Ring representative repeatedly brought up how she didn't set up two-factor authentication as an added security measure.
"The fact that they're just continuing to give customers the same blanket statement, it's like they don't seem concerned at all," she said. "To be honest, it felt like they were trying to place the blame on me. As a mother, I already feel guilty enough that I let this happen to my family. . . . There's just no need for that."
Meanwhile, Ring users elsewhere were also being hacked. Over the weekend, a family in Cape Coral, Florida, said a man started talking to them through their camera and making racist comments about their son, asking, "Is your kid a baboon, like the monkey?" WBBH reported. On Monday, the same thing happened to a woman in Atlanta, who was screamed at while in bed, as well as a couple in Grand Prairie, Texas, who say they were threatened with a ransom demand.
But LeMay said her family's experience differs from the others.
"What's so scary to us is that this person did not care that it was a young child," she said, adding: "Whoever this was, they did not stop until we unplugged the cameras. He just would not stop."
Now, Alyssa and her sisters are afraid to sleep in their bedroom. For the past few days, the girls have been camped out in the living room, LeMay said.
“This is our first house,” the mother said. “It’s really sad to not feel safe.”