I imagine that remotely disabling customers' previously-working machines for subscription ransom is at the very least grounds for a class action.
I'm not a lawyer but I would be unsurprised if there is a criminal angle to this, as well, as this is really no different from any run-of-the-mill ransomware.
I started out thinking the same but doesn't it matter that their devices have always been required to use their cloud service? This seems to be a company pivoting from a free service with an upfront hardware cost to a subscription service with the same upfront hardware cost. At least that's how I imagine they will try to spin it.
Let's not amuse ourselves by pretend threatening large companies with vague threats of lawsuits. They don't care. Lawsuits don't scare big companies. They have more, and better, attorneys than normal people.
Class actions are a little bit different. They are often undertaken and initiated by the litigating attorneys themselves if the class is sufficiently large enough to warrant it.
I actually think that the thing that can scare a big company the most is lots of little lawsuits. Or even lots of arbitration cases. There was an SV company not too long ago trying to get a judge to convert all their arbitration cases into a single class action. Because they were straining under the cost of so many individual cases.
Why even bother talking about it? Cricut's PR people aren't going to read this thread and get all scared. They probably won't even get scared if the IS a lawsuit. I'm not trying to defend the Cricut people, but there's just no real reason to threaten them with law suits online, they don't care.
I'm not a lawyer but I would be unsurprised if there is a criminal angle to this, as well, as this is really no different from any run-of-the-mill ransomware.