📹 Exposed Security Cameras: Why So Many Are Open to the Internet and How to Secure Yours (2026)

Why are so many security cameras open to the internet?

1. Default passwords. Many older cameras shipped with the same factory login on every unit. Those logins are published online. In 2014, a Russia-based site called Insecam showed feeds from cameras worldwide. It used "the default login credentials, which are freely available online" The Register (20 Nov 2014). Canada's privacy regulator later wrote that owners "had failed to change the manufacturer's default password settings" Privacy Commissioner of Canada (12 Feb 2015).

2. Weak or reused passwords on the camera account. Cloud cameras are reached through an app account. The FTC says hackers got into the accounts of about 55,000 US Ring customers FTC (31 May 2023). They used passwords leaked in other breaches (credential stuffing) and automated guessing.

3. An open door through the router. Some cameras offer a web page or an RTSP stream (a standard way to send live video over a network). Bitsight's scan looked for exactly these two kinds of open camera Bitsight (10 Jun 2025). Router features can make them reachable from the whole internet. Port forwarding sends outside traffic to one device. UPnP (Universal Plug and Play) lets devices open router ports by themselves. The UK's National Cyber Security Centre (NCSC) warns that criminals can exploit both NCSC (3 Mar 2020).

4. Unpatched software and vendor mistakes. Firmware updates fix security holes NCSC (3 Mar 2020). Sometimes the fault is the maker's. In 2012, a flaw in TRENDnet's software led to links to nearly 700 live camera feeds being posted online FTC (4 Sep 2013).

How many cameras are exposed? (what the measurements say)

Published counts of exposed cameras. Each counts something different, so they cannot be added up.

Bitsight's 40,000 is a floor, not a ceiling. The researcher called it "probably just the tip of the iceberg" Bitsight (10 Jun 2025). Bitsight also found dark-web conversations "where bad actors were discussing exposed cameras", and some people selling access Bitsight (10 Jun 2025). Bitsight sells security products, so treat its framing as a vendor's, though the count comes from its own scan.

"Vulnerable" and "open" are different claims. A camera with a known software flaw is not the same as a camera anyone can watch in a browser. Bitsight counted the second, narrower group. No one has published a checked count of the first.

What is hacked.camera, and is its "10 million cameras" figure real?

It is an anonymous website with an unverifiable number. When we checked it on 16 October 2026, its page title read "Map of 10 million cameras vulnerable to hacking". Its description says the map "shows the locations of over 10 million cameras that are vulnerable to hacking". The page names no operator. It gives no contact, no method and no privacy policy. There is no way to ask for a camera to be removed.

Without a method, nobody can test the count. It might include duplicates, cameras that are offline, or cameras that are merely a certain model rather than actually open. So we treat "10 million" as the site's own claim, not as a measurement. The checked figure remains Bitsight's 40,000 Bitsight (10 Jun 2025).

Why we do not link to it. We do not link to hacked.camera, or to any site that streams or maps other people's cameras. Doing so would send readers into strangers' homes and private spaces.

This has happened before. In November 2014, as Insecam drew attention, the UK Information Commissioner's Office urged everyone to change devices' factory passwords The Register (20 Nov 2014). The site "appeared to have gone offline after the warnings" Computerworld (20 Nov 2014). In February 2015, Canada's privacy commissioner wrote to camera makers, in a letter copied to the UK regulator. It warned that "as long as cameras remain configured in this way, the privacy risk remains" Privacy Commissioner of Canada (12 Feb 2015). It asked for unique default passwords or a forced change before first use. Similar rules later became law in California and the UK (see the laws section).

Which breaches show how cameras get exposed?

Documented camera security incidents and what came of them.

TRENDnet was the first FTC camera case. The FTC said TRENDnet failed to design and test its software securely, including the cameras' password setting. In January 2012 a hacker exploited the flaw, and links to nearly 700 live feeds were posted online FTC (4 Sep 2013). The FTC's 2013 order also required two years of free support to help customers update or uninstall the cameras FTC (4 Sep 2013).

Verkada shows business cameras are not safer by default. The FTC says the March 2021 attacker could reach "over 150,000 live Verkada customer cameras". It could "view patients in psychiatric hospitals and women's health clinics" FTC (30 Aug 2024). The FTC also alleged that Verkada "failed to require unique and complex passwords" FTC (30 Aug 2024). Verkada has said the intruder actually accessed cameras of 97 customers, out of about 6,000 at the time The Register (5 Sep 2024). Verkada neither admitted nor denied the allegations The Register (5 Sep 2024).

Wyze shows cloud mistakes can expose you without any hacker. After an outage, about 13,000 users saw thumbnail images from other people's cameras, and about 1,500 clicked on them CNN via WSAZ (21 Feb 2024).

Flock shows it reaches public-safety cameras too. 404 Media reported in December 2025 that at least 60 Flock Condor PTZ (pan-tilt-zoom) cameras were streaming on the open internet. Anyone could view a 30-day video archive and change settings, "without any username, without any password" 404 Media (22 Dec 2025). See our guides to private Flock cameras at HOAs and retailers and to Flock security research.

Is your camera exposed? How to check your own

Check from outside your home network. Bitsight's first tip is to check whether your camera can be reached from outside your home network Bitsight (10 Jun 2025). Reaching it through the maker's app or your own VPN is fine; reaching it directly is not. Turn off Wi-Fi on your phone and use mobile data. If you can open the camera's own login page or stream directly, rather than only through the maker's app, it is exposed.

Look at your router. Open your router's settings and look for port-forwarding rules you do not recognise, and for UPnP. The NCSC suggests considering switching both off, and notes this may break online gaming, media servers and some smart devices NCSC (3 Mar 2020). Your router lists connected devices, which also shows your camera's local address NCSC (3 Mar 2020).

See what scanners already know about your home address. Shodan is a search engine for internet-connected devices. Its free InternetDB service gives "a quick, at-a-glance view of the type of device that is running behind an IP address". It lists open ports, known vulnerabilities and tags, and is updated once a week Shodan InternetDB (read 16 Oct 2026). Our Connection Fingerprint tool checks InternetDB for the IP address you are using right now. Run it on your home Wi-Fi. An unexpected open port is worth tracing back to a device. Our IP lookup shows who your provider is and where your address appears to be.

The legal and ethical line: your own address and devices only. Looking up your own IP address is fine. Logging in to, or trying to get into, someone else's camera is different. In the UK, seeking access you know is "unauthorised" is an offence Computer Misuse Act 1990, s.1. US federal law covers anyone who "intentionally accesses a computer without authorization" and obtains information 18 U.S.C. § 1030. Do not test cameras you do not own or manage, even ones that look open. This is general information, not legal advice.

How do you secure your security camera?

1. Change the default password. Use a long one that you do not use anywhere else. The NCSC suggests "three random words" NCSC (3 Mar 2020). Change both the camera's own login and the app account password.
2. Turn on two-step verification. If the camera's app offers 2-step verification, switch it on NCSC (reviewed 23 Feb 2024). It asks for a code or prompt on top of your password. This is what would have stopped most Ring account takeovers; the FTC later ordered Ring to require it FTC (31 May 2023).
3. Update the firmware and turn on automatic updates. Look for "update", "firmware" or "software" in the app NCSC (3 Mar 2020).
4. Switch off remote viewing you do not need. The NCSC warns this may also stop motion alerts and smart-home links NCSC (3 Mar 2020). If you do need it, use the maker's app or a VPN into your home network rather than an open port Bitsight (10 Jun 2025).
5. Turn off UPnP and remove port forwarding on your router, unless something you rely on needs them NCSC (3 Mar 2020).
6. Put cameras on a separate network if your router allows it. A guest network or separate network for smart devices limits what a hijacked camera can reach. This is our suggestion; the sources above do not cover it.
7. Retire unsupported cameras. The NCSC says to "Think of the support date as a 'use by' date for your device" NCSC (reviewed 23 Feb 2024). A camera that no longer gets updates will not get fixes.
8. Factory-reset before you sell or give one away, and reset it if you think someone else has taken control NCSC (reviewed 23 Feb 2024).

For businesses, Bitsight adds two steps Bitsight (10 Jun 2025). Restrict access to camera feeds with firewalls and VPNs. Set alerts for unexpected login attempts. Verkada's FTC order also required multi-factor login and annual staff training The Register (5 Sep 2024).

Where should a camera never point?

Not inside bedrooms, bathrooms or other private rooms. Malwarebytes advises keeping IP cameras to "non-sensitive places as much as possible" Malwarebytes (24 Jun 2025). The Verkada breach exposed patients in clinics FTC (30 Aug 2024), and Bitsight found exposed cameras in living rooms Bitsight (10 Jun 2025). If a feed would hurt someone if it leaked, do not record it.

How do you choose a camera brand with a better security record?

• A published support period. In the UK, makers must now say how long a device will get security updates GOV.UK (29 Apr 2024). Elsewhere, check the maker's website; the NCSC suggests it NCSC (reviewed 23 Feb 2024).
• No shared default password. The camera should make you set a password at first setup NCSC (reviewed 23 Feb 2024).
• Two-step verification on the account NCSC (reviewed 23 Feb 2024).
• A way to report security bugs. UK law requires makers to publish one NCSC leaflet (read 16 Oct 2026).
• A track record you can check. Search the brand name with "FTC" or "breach". The cases above show what a regulator found and what the company was ordered to fix.

Malwarebytes also suggests researching the camera model for known vulnerabilities before buying Malwarebytes (24 Jun 2025).

What do the laws say? UK PSTI, California SB-327 and the Cyber Trust Mark

Camera-relevant rules on default passwords and security labels, checked 16 October 2026.

UK: default passwords banned for new products. The PSTI rules took effect on 29 April 2024. Makers may not use weak defaults such as "admin" or "12345" GOV.UK (29 Apr 2024). The government's announcement names webcams, smart doorbells and broadband routers among covered products GOV.UK (29 Apr 2024).

California: the first US state rule. SB-327 was approved on 28 September 2018 as Chapter 886 and has applied since 1 January 2020 SB-327 chaptered text (28 Sep 2018). It requires "a reasonable security feature". One way to meet it: "The preprogrammed password is unique to each device manufactured" SB-327 chaptered text (28 Sep 2018). The other: the user must create a new login before first access. This applies to devices with a login from outside the home network. Only the state attorney general and local prosecutors can enforce it. Consumers cannot sue under it Troutman (read 16 Oct 2026).

US: the Cyber Trust Mark is stalled. The label was announced in January 2025 and covers home security cameras and baby monitors among other devices The Hacker News (8 Jan 2025). The FCC paused it in June 2025 over concerns about the lead administrator's links to China Broadband Breakfast (7 Jan 2026). That administrator, UL, withdrew on 19 December 2025 Cybersecurity Dive (5 Jan 2026). In January 2026 the FCC was taking applications for a new one Broadband Breakfast (7 Jan 2026). We found no later status, and none of the reports we read mention a labelled product.

None of this fixes cameras already installed. These rules put duties on makers and sellers. An older camera with a shared password is still yours to fix.

Sources

Every source was read on 16 October 2026. hacked.camera was also checked that day for its own description; it is deliberately not linked. Bitsight and Malwarebytes sell security products. This page is general information, not legal advice.

1. João Cruz, Bitsight TRACE — "Bitsight Identifies Thousands of Security Cameras Openly Accessible on the Internet" (10 Jun 2025)
2. Danny Bradbury, Malwarebytes — "Thousands of private camera feeds found online. Make sure yours isn't one of them" (24 Jun 2025)
3. FTC — "Marketer of Internet-Connected Home Security Video Cameras Settles FTC Charges It Failed to Protect Consumers' Privacy" (4 Sep 2013)
4. FTC — "FTC Says Ring Employees Illegally Surveilled Customers, Failed to Stop Hackers from Taking Control of Users' Cameras" (31 May 2023)
5. FTC — "FTC Takes Action Against Security Camera Firm Verkada over Charges it Failed to Secure Videos, Other Personal Data and Violated CAN-SPAM Act" (30 Aug 2024)
6. United States v. Verkada Inc. — complaint, N.D. Cal. (Aug 2024)
7. The Register — Verkada FTC settlement report (5 Sep 2024)
8. CNN Newsource via WSAZ — "Thousands of Wyze smart camera users shown footage from other people's homes" (21 Feb 2024)
9. Jason Koebler, 404 Media — "Flock Exposed Its AI-Powered Cameras to the Internet. We Tracked Ourselves" (22 Dec 2025; partly paywalled)
10. Jeremy Kirk, Computerworld (IDG News Service) — "Governments hit back against webcam-snooping websites" (20 Nov 2014)
11. John Leyden, The Register — Insecam and the ICO warning (20 Nov 2014)
12. Office of the Privacy Commissioner of Canada — letter to IP camera manufacturers (12 Feb 2015)
13. UK National Cyber Security Centre — "Smart security cameras: using them safely in your home" (3 Mar 2020)
14. UK National Cyber Security Centre — "Smart devices: using them safely in your home" (v2.0, reviewed 23 Feb 2024)
15. UK National Cyber Security Centre — "New security law for smart devices" leaflet (undated; read 16 Oct 2026)
16. GOV.UK — "New laws to protect consumers from cyber criminals come into force in the UK" (29 Apr 2024)
17. California SB-327 (2017–18), chaptered text, Chapter 886, Statutes of 2018, via LegiScan (28 Sep 2018)
18. Troutman Pepper — "California Becomes First State to Regulate IoT Devices" (read 16 Oct 2026)
19. The Hacker News — U.S. Cyber Trust Mark launch (8 Jan 2025)
20. Cybersecurity Dive — UL withdraws as Cyber Trust Mark lead administrator (5 Jan 2026)
21. Jake Neenan, Broadband Breakfast — "FCC Looking for New Cyber Trust Mark Administrator" (7 Jan 2026)
22. Shodan — InternetDB API description (read 16 Oct 2026)
23. UK Computer Misuse Act 1990, section 1, legislation.gov.uk (read 16 Oct 2026)
24. 18 U.S.C. § 1030 (Computer Fraud and Abuse Act), Cornell LII (read 16 Oct 2026)

Related Tools & Guides

Connection Fingerprint IP Lookup Domain Exposure Check Password Security Guide Ring & Sidewalk OpSec Private Flock Cameras