Sarai Hannah Ajai Final Incident Report for May 31, 2026 | Regarding Suspected Unauthorized Wi-Fi Association of Amazon Echo Devices, Prior SSID Reuse, Router SSID Changes, Ring Camera Outage, and Possible Device/Network Compromise

June 01, 2026

Sarai Hannah Ajai Final Incident Report for May 31, 2026 | Regarding Suspected Unauthorized Wi-Fi Association of Amazon Echo Devices, Prior SSID Reuse, Router SSID Changes, Ring Camera Outage, and Possible Device/Network Compromise

Incident Report Title

May 31, 2026 Incident Report Regarding Suspected Unauthorized Wi-Fi Association of Amazon Echo Devices, Prior SSID Reuse, Router SSID Changes, Ring Camera Outage, and Possible Device/Network Compromise

Formal Incident Report Narrative

Reporting Party: Sarai Hannah Ajai
Apartment Unit: 2**
Incident Date: May 31, 2026
Primary Timeframe: Approximately 6:56 AM through 11:24 AM
Location: Reporting Party’s private apartment residence, Unit 2**
Primary Devices Involved:
Apple iPhone 17, Apple iPad M3 Air, Amazon Echo Dot, Amazon Echo Show 5, Ring camera devices, Nighthawk Dual-Band WiFi 7 Router, Amazon Alexa app-connected devices

Prepared For: Personal legal records, cybersecurity documentation, housing/security incident documentation, and possible submission to appropriate agencies or service providers.

I. Summary of Incident

On May 31, 2026, at approximately 6:56 AM, I, Sarai Hannah Ajai, changed the SSID names on my legally purchased Nighthawk Dual-Band WiFi 7 Router from the prior SSID name “House of LANisters” to the new SSID names “The Matrix Network 1” for the 2.4 GHz network and “The Matrix Network 2” for the 5 GHz network. The router password was retained but is intentionally redacted from this report for security reasons.

The purpose of the SSID change was to secure and reorganize my personal home network after prior security concerns involving my devices, Wi-Fi connections, and app-connected equipment. After changing the router network names, I began updating my personal devices to connect to the new SSID names and the same password.

During this process, I discovered that my Amazon Echo Dot and Amazon Echo Show 5 did not require ordinary reconfiguration to the newly created SSID names and shared password. Instead, evidence shown on my Amazon Echo Show 5 indicated that the Echo Show 5 was attempting to connect to, or was associated with, an SSID named “Avengers Network.” This discovery was concerning because I had previously used a similar SSID name on my own router months earlier, but I had later changed that SSID and password away from that name.

The evidence suggests that the Amazon devices were not behaving consistently with my expected router configuration history. I had personally assigned a prior SSID name similar to “Avengers Network” on or about March 27, 2026, at approximately 4:40 PM. However, on or about April 5, 2026, at approximately 1:02 PM, I changed my router SSID from that prior Avengers-related name to “House of LANisters.” Therefore, by May 31, 2026, I expected my devices to be using either the prior House of LANisters network or the newly configured The Matrix Network 1 & 2 network names and same passwords, not an Avengers-related SSID with the associated password.

Based on the screenshots attached as Exhibits A through F, the Avengers Network SSID still appeared as an available nearby Wi-Fi network on my iPad, and my Echo Show 5 displayed connection activity involving Avengers Networkafter I had changed my own router to the new The Matrix Network 1 & 2 SSID names with the same password. This raised a serious concern that an unknown person or persons may have created, reused, mirrored, cloned, or otherwise broadcast a Wi-Fi SSID similar to my prior router name in a manner that caused my Amazon devices to associate with that network, or caused those devices to attempt to connect to that network.

At this time, I do not have direct router logs, Amazon device logs, or law-enforcement forensic confirmation identifying the specific person or persons responsible. However, based on my observations, the screenshots, the history of my router SSID changes, and the behavior of my Amazon Echo devices, I reasonably believe this incident should be documented as a suspected unauthorized network association and possible devices compromises.

II. Prior Router SSID History

Before the May 31, 2026 router update, my home network had the following relevant SSID history:

March 27, 2026, approximately 4:40 PM
I assigned my Nighthawk Dual-Band WiFi 7 Router an SSID name similar to “Avengers Network” or “Avengers Networks.” The router password used at that time is redacted from this report.
April 5, 2026, approximately 1:02 PM
I changed my router SSID from the Avengers-related SSID to “House of LANisters.” The password used is redacted from this report.
May 31, 2026, approximately 6:56 AM
I changed my router SSID again from “House of LANisters” to:
2.4 GHz: The Matrix Network 1
5 GHz: The Matrix Network 2
The password is redacted from this report.

Because I had already changed away from the Avengers-related SSID name and password on April 5, 2026, I did not expect my Amazon Echo and Dot devices to display, rely upon, or connect to an Avengers-related network on May 31, 2026.

III. Detailed Incident Description

After completing the router SSID update on May 31, 2026, I began updating my personal Apple devices and app-connected devices to the new SSID The Matrix Network 1 or 2 names and passwords. My Apple iPad M3 Air and Apple iPhone 17 showed connection to The Matrix Network 1, which confirmed that the router change was active and that my Apple devices were connecting to the intended current Wi-Fi network.

While reviewing my devices, I discovered that my Amazon Echo Show 5 displayed a message stating that the device was connecting to a saved Wi-Fi network named “Avengers Network.” This was concerning because I had not configured my current router to use that SSID, The Matrix Network 2 name on May 31, 2026. In addition, the Echo Show 5 settings screen later displayed Network: Avengers Network, indicating that the Echo device was associated with, or attempting to associate with, that network name.

At approximately 10:37 AM, my iPad showed that it was connected to Echo Dot, SSID, The Matrix Network 1, while Avengers Network appeared under nearby available networks. This suggests that the Avengers Network SSID with the associated password was broadcasting nearby at the time. Because I had already changed my router name away from the Avengers-related SSID with the associated password weeks earlier, the appearance of that network as a separate available SSID caused concern.

At approximately 10:47 AM, my Echo Show 5 displayed the message: “Device connecting to your saved wifi network — Avengers Network.” This indicated that the Echo Show 5 was attempting to connect to Avengers Network rather than the current The Matrix Network 2, SSID name and password.

At approximately 11:05 AM, my Ring app displayed multiple camera devices as Device Offline, including Bedroom Window, Front Door Apt 2**, and Kitchen. This occurred during the same general timeframe in which I was updating my home network configuration and observing the Amazon Echo device connection issue. The Ring cameras outage further supports my concern that the network transition or possible unauthorized Wi-Fi association affected multiple connected devices.

At approximately 11:15 AM, my Echo Show 5 again displayed “Device connecting to your saved wifi network — Avengers Network.” This showed that the Echo Show 5 continued attempting to use the Avengers Network SSID name with the associated password even after my router had been changed to The Matrix Network 2 SSID name and password.

At approximately 11:21 AM, the Echo Show 5 settings page displayed Network: Avengers Network, with Bluetooth showing no connected device. This is significant because it shows the Echo Show 5 identifying Avengers Network as its active or selected network in the device settings.

At approximately 11:24 AM, my iPhone 17 settings screen showed that my iPhone 17 was connected to The Matrix Network 1, with Bluetooth on, Personal Hotspot off, and VPN not connected. This confirmed that my Apple iPhone 17 was using the current intended SSID while my Echo Show 5 was still displaying the older Avengers-related SSID name.

IV. Suspected Unauthorized Conduct

Based on the above facts and observations, I believe this incident may involve one or more of the following suspected issues:

Possible unauthorized Wi-Fi SSID reuse or impersonation
An unknown person or device may have broadcasted an SSID named Avengers Network, which was similar to an SSID I had previously used on my Nighthawk Dual-Band WiFi 7 Router.
Possible unauthorized association of Amazon devices with a non-current Wi-Fi network
My Amazon Echo Dot and Echo Show 5 appeared to be linked to, or attempting to connect to, Avengers Network even though my current router The Matrix Network 1 & 2 SSID names with same password had already been changed.
Possible unauthorized access to Amazon Alexa-connected device settings
I have previously experienced incidents where announcements or text entries associated with my Amazon devices appeared to contain derogatory or altered wording, then later appeared corrected. I believe this may indicate that an unknown person or persons were accessing or manipulating Amazon app-connected device settings.
Possible use of a cloned, mirrored, or otherwise compromised Apple iPhone session
Because my Amazon Alexa app is accessed from my Apple iPhone 17, I am concerned that someone may have used a cloned, mirrored, compromised, or unauthorized session involving my Apple iPhone 17 or related account credentials to access or alter Amazon device settings.
Possible physical proximity issue
Because Amazon Echo and Dot devices generally require local setup, saved Wi-Fi credentials, Bluetooth, app access, or proximity-based configuration steps, I am concerned that an unknown person may have come within close range of my apartment unit, Unit 205, or otherwise used unauthorized access methods to influence the devices’ Wi-Fi configuration.
Possible network disruption affecting security cameras
The Ring cameras outage shown at approximately 11:05 AM may have resulted from the router of The Matrix Network 1 & 2 SSID with same passwords changes, ordinary reconnection delay, or possible an unauthorized network interference. The cause is not confirmed from the screenshots alone, but the outage occurred during the same timeframe as the Echo device Wi-Fi irregularities.

I am documenting these concerns as suspected unauthorized misconduct. I am not claiming that the screenshots alone identify the responsible individual. However, the screenshots provide contemporaneous evidence of abnormal network behavior, device connection problems, and continued use or attempted use of an SSID name that was no longer my current router SSID names with the associated passwords.

V. Exhibit List and Evidence Description

Exhibit A — iPad M3 Air Wi-Fi Settings at approximately 10:37 AM

This screenshot shows the iPad Wi-Fi settings page on Sunday, May 31, at approximately 10:37 AM. The iPad is connected to The Matrix Network 1, confirming that my updated router SSID was active and being used by my Apple device. The same screen also shows Avengers Network listed under “Other Networks,” indicating that an SSID named Avengers Network was broadcasting nearby at that time. This is important because my own router had already been changed away from an Avengers-related SSID before May 31, 2026.

Exhibit B — Echo Show 5 at approximately 10:47 AM

This screenshot shows the Echo Show 5 displaying the message: “Device connecting to your saved wifi network — Avengers Network.” This is significant because it shows the Echo Show 5 attempting to connect to the Avengers Network SSID after I had changed my current router SSID to The Matrix Network 1 and The Matrix Network 2.

Exhibit C — iPhone 17 Ring App at approximately 11:05 AM

This screenshot shows the Ring app camera list with multiple devices marked Device Offline, including Bedroom Window, Front Door Apt 2**, and Kitchen. This occurred during the timeframe when I was updating devices to the new router SSID and observing the Amazon Echo connection issue. The screenshot documents that my camera system was affected or offline during this incident window.

Exhibit D — Echo Show 5 at approximately 11:15 AM

This screenshot again shows the Echo Show 5 displaying: “Device connecting to your saved wifi network — Avengers Network.” This indicates that the device was still attempting to connect to Avengers Network approximately 28 minutes after Exhibit B and after the new Matrix SSID had already been configured.

Exhibit E — Echo Show 5 Settings Screen at approximately 11:21 AM

This screenshot shows the Echo Show 5 settings screen. Under the network section, it displays “Avengers Network.”Bluetooth shows no connected device. This exhibit is important because it shows the Echo device’s own settings page identifying Avengers Network as the associated network.

Exhibit F — iPhone 17 Settings at approximately 11:24 AM

This screenshot shows my iPhone 17 settings page at approximately 11:24 AM. The iPhone is connected to The Matrix Network 1, Bluetooth is on, Personal Hotspot is off, and VPN is not connected. This confirms that my iPhone was connected to the intended updated Wi-Fi network while the Echo Show 5 continued to display Avengers Network.

VI. Security and Privacy Impact

This incident caused serious concern because Amazon Echo and Dot devices are microphone-enabled, app-connected, and linked to personal household automation functions. If an unauthorized person caused or influenced these devices to connect to an unknown Wi-Fi network, the incident could have affected the privacy, security, and reliability of my apartment unit, 2** network and connected devices.

The incident also affected my ability to rely on my Ring cameras system during the same period. Multiple Ring camera devices showed offline status, including cameras used to monitor my apartment unit, 2** and common-area safety concerns. Any disruption to those devices creates a safety and documentations concern because I rely on those cameras to preserve evidence and monitor activity near my residence.

The incident also raises concerns regarding account integrity, because Amazon Echo and Dot devices are connected through the Amazon Alexa app, and the Alexa app is accessed from my Apple iPhone 17. If unauthorized persons accessed the Alexa app, mirrored my iPhone 17 session, obtained prior Wi-Fi credentials, or used a cloned device environment, then my Amazon account, Apple device security, router security, and Ring cameras security may all require further review.

VII. Prior Pattern of Concern Involving Amazon Announcements

I have previously observed suspicious behavior involving my Amazon devices after they appeared to be under outside influence. Specifically, I have experienced incidents where public announcement text or device announcement wording appeared to contain derogatory or inappropriate comments after sensors or routines were activated. My concern is that unknown persons may have accessed the Amazon Alexa app, altered announcement texts, allowed the device to speak the altered announcement, and then changed the text back to the correct wording afterward.

This prior pattern is relevant because the May 31, 2026 incident involved Amazon Echo and Dot devices displaying an unexpected Wi-Fi SSID association. The Wi-Fi issue may be related to the same broader concern involving unauthorized access to Amazon-connected devices, Alexa app settings, and my Apple iPhone 17 device environment.

VIII. Evidence Preservation

I preserved the following evidence:

Screenshots from my iPad M3 Air Wi-Fi settings.
Screenshots of my Echo Show 5 showing connection to or attempted connection to Avengers Network.
Screenshot from my Ring app showing multiple cameras offline.
Screenshot from my iPhone 17 showing connection to The Matrix Network 1.
Date and approximate time references shown in the screenshots.
My personal timeline of router SSID changes from March 27, 2026, April 5, 2026, and May 31, 2026.

I intentionally redacted Wi-Fi passwords from this report to protect my network credentials.

IX. Requested Follow-Up Actions

I request that this incident be preserved as part of my ongoing personal security documentation. I also intend to consider the following follow-up actions:

Review Nighthawk router logs, connected-device lists, blocked-device lists, and MAC address history.
Change the router administrator password.
Change the Wi-Fi password again using a new strong password not previously used.
Disable WPS if enabled.
Confirm WPA3 or WPA2/WPA3 security settings are active.
Remove saved Wi-Fi credentials from Amazon Alexa devices and manually reconnect them only to the current intended SSID.
Deregister and re-register Echo devices if necessary.
Review Amazon account login history, Alexa device history, routines, announcements, and linked devices.
Change the Amazon password and confirm multi-factor authentication is enabled.
Review Apple ID device list and remove any unrecognized device.
Change Apple ID password and verify account recovery settings.
Review Ring account login history, shared users, camera network status, and device health reports.
Preserve all screenshots and any future router logs as evidence.
Consider reporting the incident to Amazon, Ring, Apple, Netgear/Nighthawk support, the property manager, and appropriate law-enforcement or cybercrime reporting agencies if additional evidence supports unauthorized access.

X. Suspected Unauthorized Entry Into Apartment Unit 2** or Close-Proximity Access to Devices Located Inside Unit 2**

Based on the location of my Amazon Echo Dot and Amazon Echo Show 5 inside my private apartment unit, 2**, and based on the devices showing connection activity involving the SSID name “Avengers Network” with the associated password, after I had already changed my legally purchased Nighthawk Dual-Band WiFi 7 Router away from that Avengers-related SSID with the associated password, I suspect that an unknown person or persons may have unlawfully entered, approached, or otherwise obtained close-proximity access to my apartment unit or the devices located inside Unit 2**. My concern is that the Amazon Echo Dot and Echo Show 5 would ordinarily require either authorized Amazon account access, saved Wi-Fi credentials, Bluetooth/proximity setup access, direct device access, or close physical proximity to complete or influence a Wi-Fi network association. Because I did not authorize any person to enter my apartment unit 2**, access my Amazon devices, use my Amazon Alexa app, connect those devices to an outside or unknown SSID and password, or reuse an older Avengers-related SSID name with the associated password after I had changed my own router SSID names, I believe this conduct should be documented as suspected unauthorized access, suspected close-proximity device manipulation, and possible unlawful entry or attempted access affecting devices located inside Apartment Unit 2**.

At this time, I cannot identify the responsible person or persons from the screenshots alone. However, the device behavior, the prior SSID name with the associated password history, the Amazon Echo Show 5 screenshots, and the fact that the devices are physically located inside my private residence support my good-faith belief that someone may have had unauthorized access to the device environment, either by physical proximity to Unit 2**, unauthorized account/session access, unauthorized Wi-Fi credential use, or a combination of those methods.

XI. Statement of Good-Faith Belief

I am making this report based on my personal observations, device screenshots, router SSID history with the associated passwords, and the behavior of my Amazon Echo, Dot and Ring devices on May 31, 2026. I believe the incident raises legitimate concerns regarding possible unauthorized Wi-Fi association, possible SSID impersonation, possible access to Amazon-connected device settings, and possible interference with my personal apartment security devices.

The screenshots do not independently identify the person or persons responsible. However, they document that an SSID named Avengers Network and the associated password appeared nearby and that my Echo Show 5 displayed connection activity involving that SSID after my router had been changed to different SSID names with the same passwords. For that reason, I am preserving this report and the attached exhibits as part of my official incident documentations.

Prepared by: Sarai Hannah Ajai
Date Prepared: May 31, 2026
Related Evidence: Exhibits A through F
Passwords: Redacted for security purposes