What Is This About?

If you recently received a letter or an email from HP Poly informing you that your sensitive personal information was compromised in a data breach, we would like to speak with you about your rights and potential legal remedies. HP Poly recently disclosed that it was the victim of a security vulnerability affecting certain HP Poly Voice VoIP phones that could expose individuals’ sensitive information if exploited.

What Happened?

On or before 2026-06-02, a critical remote code execution vulnerability (CVE-2026-0826) was publicly disclosed affecting multiple HP Poly Voice VoIP phones, including HP VVX series and Trio IP Conference series devices. The reported issue is a stack-based buffer overflow that occurs while parsing Session Description Protocol (SDP) attributes when ICE is enabled. If exploited, the vulnerability could allow an attacker to execute arbitrary code with root privileges on affected devices within an enterprise network environment. Based on the available information, HP Poly made patches available and noted that disabling ICE connectivity may serve as a temporary mitigation. The provided materials do not specify the date the vulnerability was first exploited in the wild (if at all), when HP Poly first became aware internally, whether third-party forensic investigators were hired, the number of impacted individuals, whether any specific consumer notice letters were sent, or whether any Attorney General or other government filings were made.

What Information Was Impacted?

Upon information and belief, the following types of sensitive personal information may have been compromised:

• Not specified;

What Action Can You Take?

Levi & Korsinsky, LLP is investigating whether affected users are entitled to compensation. If you received a notice from HP Poly, there is no cost or obligation to participate. Follow the link below to find out about your rights and potential legal remedies available.