Four more U.S. states have filed lawsuits against TP-Link Systems, alleging the router maker misled customers about the security of its products and about how separate the company is from China. TP-Link has denied the allegations and said it will contest the claims in court.

Although the legal action is taking place in the United States, the case is relevant for European businesses because routers and network equipment sit at the core of office, retail, warehouse and remote-work infrastructure. Allegations around device security, update practices and corporate control can affect procurement decisions, risk assessments and supplier due diligence.

What happened

According to the source, Florida, Iowa, Montana and Nebraska filed suit on October 6, adding to an earlier case brought by Texas in February. The states allege that TP-Link Systems misrepresented both the security of its routers and the degree of its independence from China.

At this stage, these are allegations in civil lawsuits, not court findings. TP-Link has denied the claims. The source provided does not indicate a final judgment or regulatory ruling.

Why it matters for European businesses

For European companies, the immediate issue is not U.S. state law but vendor risk. Routers are critical devices that connect offices, stores, production sites and cloud systems. If a vendor faces credible scrutiny over security claims, businesses may need to review whether their own assumptions about device safety, patching and support remain justified.

The case also touches on supply-chain transparency. Many organisations are paying closer attention to where technology is developed, how products are maintained, and what level of visibility they have into ownership, software updates and support channels. This is especially relevant for businesses handling sensitive customer data, operating multiple sites, or relying on always-on internet connectivity for sales and operations.

European companies in regulated sectors may already be under pressure to strengthen cyber governance through frameworks such as NIS2-related national rules or internal supplier-security policies. Even where no specific ban or legal restriction applies, disputed security marketing claims can trigger internal reviews by IT, procurement and compliance teams.

Who may be affected

• SMEs and multi-site businesses using low-cost routers in offices, retail branches or warehouses
• E-commerce companies whose operations depend on stable and secure network connectivity
• IT teams and managed service providers responsible for router deployment, firmware updates and network segmentation
• Regulated businesses that must document supplier risk and security controls
• Founders and operations leaders making cost-driven infrastructure decisions without deep vendor reviews

What companies should consider

• Review router inventory: Identify where TP-Link or other low-cost network devices are deployed across offices, stores and remote sites.
• Check update and support status: Confirm firmware is current, remote administration is limited, and unsupported devices are scheduled for replacement.
• Assess supplier due diligence: Document what security assurances, certifications and support commitments you rely on when buying network equipment.
• Segment critical systems: Keep payment systems, business applications, cameras and guest Wi-Fi on separate networks where possible.
• Prepare alternatives: If procurement or compliance concerns increase, evaluate replacement vendors before an urgent switch is needed.
• Avoid overreacting to allegations alone: The lawsuits do not by themselves prove wrongdoing, but they are a useful trigger for reviewing network-device risk.

For European businesses, the practical takeaway is clear: network hardware should be treated as a strategic security dependency, not just a commodity purchase. Legal disputes over security claims can quickly become an operational and governance issue for companies that rely on those devices every day.