Starting in September 2014, Lenovo shipped consumer laptops with pre-installed Superfish VisualDiscovery adware that intercepted all HTTPS traffic using a self-signed root certificate. This effectively broke the encryption of every secure website — banking, email, medical — enabling man-in-the-middle attacks. The same root certificate and weak private key were used on all affected PCs, meaning anyone who extracted the key could intercept any affected user's encrypted traffic. DHS issued an advisory to uninstall immediately.