Peloton Outage Prevents Customers From Using $2,500 Exercise Bikes

from the dumb--tech-is-smart-tech dept

Peloton hasn't been having a great run lately. While business boomed during the pandemic, things have taken a sour turn of late on a bizarre host of fronts. In just the last month or two the company has seen an historic drop in company valuation, fired 20 percent of its workforce, shaken up its executive management team, been forced to pause treadmill and bike production due to plummeting demand, been the subject of several TV shows featuring people having heart attacks, and now has been caught up in a new scandal for trying to cover up a rust problem to avoid a recall.

Some of the issues have been self-inflicted, while others are just the ebb and flow of the pandemic. Most users still generally love the product, and a lot of these issues are likely to fade away over time. But adding insult to injury, connectivity issues this week prevented Peloton bike and treadmill owners from being able to use their $2000-$5000 luxury exercise equipment for several hours Tuesday morning. The official Peloton Twitter account tried to downplay the scope of the issues:

For much of Tuesday morning the pricey equipment simply wouldn't work. I have a Peloton Bike+, and while the pedals would physically spin, I couldn't change the resistance or load into my account; you just were stuck staring at a loading wheel in perpetuity. Some app users say they had better luck, but many Bike, Bike+, and Peloton Tread owners not only couldn't ride in live classes, they couldn't participate in recorded classes because there's no way to download a class to local storage (despite the devices being glorified Android tablets).

The outage (which occurred at the same time as a major Slack outage) was ultimately resolved after several hours, but not before owners got another notable reminder that dumb tech can often be the smarter option. Your kettlebells will never see a bungled firmware update or struggle to connect to the cloud.

Filed Under: connected bikes, iot
Companies: peloton

You Don't Own What You've Bought: Peloton Treadmill Edition

from the everything-costs-money dept

We've written so many stories about how you don't own what you've bought any more due to software controls, DRM, and ridiculous contracts, and it keeps getting worse. The latest such example involves Peloton, which is most known for its extremely expensive stationary bikes with video screens, so that you can take classes (usually on a monthly subscription). I will admit that I don't quite understand the attraction to them, but so many people swear by them. The company also has branched out into extremely expensive treadmills with the same basic concept, but that product has been in the news for all the wrong reasons lately, after a six year old child died in an accident with the device (for what it's worth, that article links to a page on the Peloton site where the article says Peloton posted an open letter to its customers about the accident, but the letter is no longer at that link).

The death kicked off an investigation by the US Consumer Product Safety Commission, which then told Peloton it should recall the treadmills and that people should not use them if there are children or pets nearby and apparently you should lock yourself in a room with them:

If people want to keep using the Tread+, they should only do so in a locked room and they should keep other objects away, the agency said. It advised people to unplug the treadmill while not using it and to keep the key to turn it on elsewhere and away from the reach of kids.

In a move that seemed guaranteed to generate bad PR, Peloton fought back against the recommendation calling it "inaccurate and misleading." It wasn't a very good look, and a few weeks later the company did, in fact, issue a recall -- though reports note that very few people will take the company up on the recall.

Not surprisingly, the company is also now facing some class action lawsuits. In that article, it notes that even for people who do not return their recalled Peloton treadmills, the company will issue a software update to try to maintain better safety and avoid children (and pets) from trying to use the device:

Peloton announced that they will refund the machine, which costs $4,295, and are working on a mandatory software update that will automatically lock the Tread+ after each use and require a unique password to be used to unlock the machine.

That automatic lock and password idea sounds sensible enough, given the situation, but in order to get it to work, but apparently Peloton hasn't figured out how to make that work for customers who bought the treadmill and aren't using its subscription service for classes. The Tread+ does have a "Just Run" mode, in which it acts like a regular treadmill (with the video screen off). But, as Brianna Wu discovered, the company is now saying that the "Just Run" mode now requires a subscription to work with the lock. The company is waiving the cost of such a subscription for three months, and it's unclear from the email if that means that after the three months they're hoping to have the "Tread Lock" working even for non-subscription users:

If you can't see it, the image is an email from Peloton customer support saying:

We care deeply about the safety and well-being of our Members and we created Tread Lock to secure your Tread+ against unauthorized access.

Unfortunately at this time, 'Just Run' is no longer accessible without a Peloton Membership.

For this inconvenience, we have waived three months of All-Access Membership for all Tread+ owners. If you don't see the waivers on your subscription or if you need help reactivating your subscription, please contact our Support team....

Now, it's possible that the subscription part is necessary to update the software to enable the lock mode, but that seems... weird. After all, there must have been some sort of software upgrade that locked out the "Just Run" mode in the first place.

And, obviously, you can understand why (given what happened), Peloton wants to make sure that everyone has upgraded with these new safety features. But the email is woefully unclear on whether or not after the three months of free membership, you'll have to start paying the $40/month to keep using the treadmill, or if it just becomes a quite expensive piece of weird furniture.

I get the need to deal with the risk of harm... but you'd think that the company would have done a better job of making sure it did so in a manner that didn't mean forcing people into a subscription they might not want. Indeed, as basically anyone could have predicted, once this started getting attention, Peloton promised that it was working hard to figure out a way to re-enable "Just Run" without a subscription. Of course, if that was always the plan, you'd think that the email would have said something, because otherwise, this concern was wholly predictable.

Either way, it's yet another reminder of how we don't truly own what we've bought any more thanks to such software locks and the ability to update things after they've been purchased, including taking away features. And that should concern everyone.

Filed Under: drm, just run, ownership, recall, safety, treadmill
Companies: peloton

Peloton Is Having A Rough Week: Product Safety Recalls And News Of Customer Data Exposure

from the spinning-in-circles dept

Peloton is, as they say, having a rough week. While the company has been something of a pop culture darling for several years, it also got a nice boost from this lovely COVID-19 pandemic we've all been suffering through for more than a year now. Still, no company gets through its full lifecycle unscathed and this week has been a week I'm certain the Peloton folks would love to forget. We'll get started with the less-Techdirt centric part of this, which is that Peloton recently had to recall two of its treadmills after it turns out those treadmills occasionally enjoy eating people, especially very young children.

Peloton has received at least 72 reports of adults, children, pets and/or objects getting dragged under their Tread+ treadmill. In those incidents, 29 children suffered injuries, which included second- and third-degree abrasions, broken bones, and lacerations, the US Consumer Product Safety Commission noted.

In February, a father reported to the CPSC that his 3-year-old son was pulled under a Tread+ and trapped. When the father discovered his son and was able to free him, the toddler was pulseless and not breathing, according to the report. Fortunately, the boy was resuscitated, but he “now has significant brain injury.” The boy had tread marks on his back matching the slats of the Tread+, as well as a neck injury, and petechiae (small blood spots) on his face, presumably from blood flow being cut off.

When Peloton learned of the “unthinkable” death of the 6-year-old in March, Peloton CEO John Foley sent a note to customers noting the “tragic accident” and highlighting safety warnings for its treadmills. The March 18 note cautioned customers to “keep children and pets away from Peloton exercise equipment at all times.”

Those warnings were glaringly insufficient and the CPSC basically told people to stop using the product. In mid-April, Peloton's CEO informed customers that the company was aware of the CPSC advice, but that the company was not planning to stop selling the treadmills at all. Instead, the company essentially said that if the product warnings were adhered to, there was no problem. It was only this week when the company admitted that this was a mistake in approach and issued a recall for the two treadmills in question. That it should have done so, and subsequently added physical protection to its products to avoid all of this, really should have been painfully obvious once we got to the part where a 3 year old suffered lifelong injuries and treadmarks across his back and another child... you know... died.

But the troubles for the company keep on coming. The most recent news is that security researchers found that Peloton had exposed customer data to, well, basically anyone with a little technical know-how and then tried to keep the whole thing silent with an enormously insufficient "fix."

Researchers at security consultancy Pen Test Partners on Wednesday reported that a flaw in Peloton’s online service was making data for all of its users available to anyone anywhere in the world, even when a profile was set to private. All that was required was a little knowledge of the faulty programming interfaces that Peloton uses to transmit data between devices and the company’s servers.

The reporting indicates that this exposure included customer information such as their user IDs, group memberships, workout information, age, gender, weight, and more. You know, probably not the sort of thing customers that set their profiles to private while trying to exercise and/or lose weight would want exposed to anyone that wanted to take a look. The APIs apparently required no authentication. When Pen Test Partners reached out to the company and informed them of all of this, the company immediately acknowledged the information... and then did nothing for two weeks.

Two weeks later, the Peloton rolled out a half-fix without informing anyone.

Rather than providing the user data with no authentication required at all, the APIs made the data available only to those who had an account. The change was better than nothing, but it still let anyone who subscribed to the online service obtain private details of any other subscriber. When Pen Test Partners informed Peloton of the inadequate fix, they say they got no response. Pen Test Partners researcher Ken Munro said he went as far as looking up company executives on LinkedIn. The researchers said the fix came only after TechCrunch reporter Zack Whittaker, who first reported the leak, inquired about it.

"I was pretty pissed by this point, but figured it was worth one last shot before dropping an 0-day on Peloton users," Munro told me. "I asked Zack W to hit up their press office. That had a miraculous effect – within hours I had an email from their new CISO, who was new in post and had investigated, found their rather weak response and had a plan to fix the bugs."

This doubling up of a callous response to the physical and virtual safety of its own customers is a horrible look for Peloton. Again, with the exception of a possibly ill-conceived advertisement campaign a few years back, this company is an absolute media darling with a fair amount of good will built up for itself. Simply by not taking its customer's safety seriously, that good will seems to be pretty seriously at risk.

And, it's worth noting, breaches and exposures like this almost always turn out to be more serious than first reported. Maybe that won't be the case this time. Or maybe Peloton's bad time is about to get even worse.

Filed Under: api, data leak, recall
Companies: peloton

Peloton Seeks To Invalidate 'Spinning' Trademark Held By Trademark Bully

from the spin-cycle dept

Back in 2010, we discussed that the at-the-time "spin class" craze in the fitness world was encountering the fact that one company, Mad Dogg Athletics, held a trademark on the term "spinning" for use in the fitness industry. Mad Dogg had taken to going around the world and threatening anyone else using the term with trademark infringement as a result. And, to be clear, they had a lot of targets for these threats, which factored into the argument that term was now generic and hadn't been properly enforced as a trademark for years.

Since 2010, the spin class craze has morphed out of the brick and mortar gym and into home fitness, with the current fad being app-driven home stationary spin bikes. The leader in that field is, of course, Peloton. Mad Dogg sued Peloton for trademark infringement last year over patents it holds for core features of its bikes. In what may be something of a clap back in that dispute, however, Peloton has now petitioned to have Mad Dogg's "spinning" trademark canceled entirely.

Peloton claimed that rival fitness company Mad Dogg Athletics is “abusively enforcing” its trademark rights of ‘Spinning’ and ‘Spin’ across the indoor biking industry in a petition filed to the US Patent and Trademark Office’s Trademark Trial and Appeal Board (USPTO) yesterday.

The petition argued that the terms are generic and that Mad Dogg’s lawyers have been ceaseless in their campaign to chase down infringers. It also cites John Baudhuin, co-founder of Mad Dogg, admitting to spending “hundreds of thousands of dollars a year” on litigation.

This is Peloton calling out the game, which is very useful. Rather than focusing primarily on the business of selling spin bikes, Mad Dogg instead seems to be focused on policing its trademark. The argument that the term "spinning" has become generic is only bolstered by the high volume of victims of Mad Dogg's bullying. In addition, it would be interesting to see Mad Dogg attempt to come up with any evidence that the wider public currently associates the term with its products, because that feels like it would be a stretch to say the least.

Peloton's petition calls out the extremes to which Mad Dogg has gone in its bullying.

“Enough is enough. It is time to put a stop to Mad Dogg’s tactic of profiting by threatening competitors, marketplaces and even journalists with enforcement of generic trademarks.”

Imagine the instant good the USPTO could do simply by invalidating a trademark for what has become a generic term in the fitness industry.

Filed Under: spinning, trademark, upsto
Companies: mad dogg athletics, peloton

The Next Risk In Buying An IOT Product Is Having It Bricked By A Patent Dispute

from the patently-lame dept

In the world of the Internet of Broken Things, there is nothing more impressive to me than the fact that these things actually sell as well as they do. The risks associated with internet-connected devices seem insurmountable, save for the fact that we are all cattle being marched along to the slaughterhouse, our faces as serene as could be. Between companies simply deciding that supporting these products isn't worth it any longer and reducing functionality, firing off firmware updates that simply kill off selling-point features, or leaving security holes wide enough to drive a malicious creepster through, it seems that very little thought goes into the fact that customers are, you know, buying these things. Once that purchase is made, how long that purchase is functional and secure appears to be an afterthought.

But the risks apparently don't end there. Let's say you bought an IoBT device. Let's say you enjoyed using it for months, or years. And then let's say that the company you bought it from suddenly got sued for patent infringement, settled with the plaintiff, and part of that settlement is, oops, your shit doesn't work any longer? Well, in that case, you're an owner of a Flywheel home exercise bike, which settled for patent infringement with nevermind-you-already-know-who.

Every morning at 4:30AM, Shani Maxwell would throw on her Flywheel T-shirt and hop on her Fly Anywhere bike. An avid fan who’s been riding with Flywheel since 2013, she’d leapt at the chance to own the company’s branded bike when the company released its Peloton competitor in 2017.

So it came as a surprise when she received an email from Peloton, not Flywheel, informing her that her $1,999 bike would no longer function by the end of next month. Flywheel settled a patent dispute with Peloton earlier in February and decided after the lawsuit to discontinue the at-home bike product.

“It shocked me,” Maxwell says. “We knew the lawsuit was in progress and we heard the settlement had been reached — we just didn’t realize they would shut down. ”

In fact, I'm sure Maxwell wasn't even aware that it was a possibility that the product she bought just wouldn't work anymore some day. Due to some intellectual property dispute to which she wasn't a party. To be clear, there wasn't any real choice given in any of this, either. The settlement included having Peleton reach out and offer to replace the Flywheel bike with a refurbished Peleton. If the customer didn't want the used Peleton bike, well, they could fuck right off with no recompense.

It's important to keep in mind at this point that people paid for these bikes and the service they came with. Paid very real money for a product that, poof, disappeared one day. Most Flywheel customers apparently took the deal with Peleton. After all, the other option sucks out loud. Some of them were quite mad about it.

But most? Well, serene-faced cattle marched towards the slaughterhouse.

For Podnos, the Flywheel experience was just another lesson in taking a chance with the Internet of Things. “It’s the risk you take when signing up for a platform that is still in development. It was a risk factor that we weighed from the onset, and were comfortable with,” he said. “I don’t think it will dissuade me from trying new IoT services, but it’s certainly a cautionary tale that consumers should be aware of.”

This is why we can't have nice things. Or things at all, it seems.

Filed Under: bikes, broken things, internet connected bikes, iot, ownership, patents
Companies: flywheel, peloton