Can Security Cameras Be Hacked? Published Incidents by Brand
Yes, and it has happened at major brands. Per the FTC's 2023 complaint, hackers exploiting weak account security, including credential stuffing with reused passwords, reached the videos and live streams of about 55,000 US Ring customers. A 2024 Wyze server error showed about 13,000 users other people's camera thumbnails. Turning on two-factor login and keeping firmware updated addresses the route used in the Ring case.
Figures researched 2026-10-01; each source below carries its access date. Prices change; treat any price here as "as of" its date.
What camera security incidents are on the record?
This table lists incidents documented by a regulator or by the company itself. It leaves out unverified forum reports and researcher claims a company disputed.
| Brand | When | What happened | Outcome |
|---|---|---|---|
| Ring (home cameras) | Complaint and proposed order May 31, 2023 | The FTC alleged any employee or contractor could access customers' private videos, and that hackers used credential stuffing to reach stored videos, live streams and account profiles of about 55,000 US customers. Ring did not implement multifactor authentication until 2019, despite attacks in 2017 and 2018 | Proposed order: $5.8 million in consumer refunds, a privacy and security program, multifactor authentication for employee and customer accounts |
| Eufy (home cameras) | Settlement January 28, 2025 | New York's Attorney General found that in certain situations video sent over the internet was not end-to-end encrypted, part of the connection used no encryption, and streams could be reached by anyone with the relevant link | $450,000 from three US distributors, who must show that Eufy's developer encrypts video in storage and transit and runs a vulnerability management program |
| Wyze (home cameras) | February 16, 2024 | During recovery from an outage Wyze attributes to its partner AWS, about 13,000 users received thumbnails from cameras that were not their own and 1,504 tapped on them; in some cases an event video could be viewed. Wyze blamed a third-party caching library | Wyze added a verification layer before users connect to event videos |
| Verkada (business cameras) | FTC action August 30, 2024 | A hacker in March 2021 had access to over 150,000 live Verkada customer cameras | Information security program with third-party audits; separate $2.95 million penalty for CAN-SPAM email violations |
Verkada sells to businesses, not homes, but the case shows that "security company" does not mean secure.
How do cameras actually get compromised?
The documented cases and the regulators' guidance point to three routes in.
Reused passwords (credential stuffing). Attackers take usernames and passwords leaked from other sites and try them on camera accounts. The FTC defines credential stuffing this way in the Ring case, and it is why Ring's order requires multifactor authentication. This is the risk you control directly.
Company-side failures. Weak encryption (the Eufy settlement), a server bug that mixed up accounts (Wyze), or broad internal access to videos (the Ring complaint). No setting on your end fixes these; the choice of brand, and whether it stores your video on its servers, is what changes your exposure.
Unpatched devices. Cameras run firmware that needs security updates. The FCC's U.S. Cyber Trust Mark, a voluntary label for wireless consumer devices that names home security cameras as an example, links to a registry showing whether updates are automatic and the date the maker stops supporting the product.
Recording locally reduces the amount of video sitting on a company's servers, though most local-storage cameras still use the maker's cloud for remote viewing; the Eufy case involved a brand marketed on local storage. The storage trade-offs are covered in local vs cloud storage for security cameras, and Eufy's current plan and storage setup is in does Eufy require a subscription.
Which settings reduce the risk?
The first four steps below come from the FTC's consumer guidance on internet-connected devices; the last two are common-sense additions of ours.
| Step | Why it matters |
|---|---|
| Turn on two-factor authentication on the camera account | A stolen password alone is no longer enough to log in, the route in the Ring case |
| Use a unique password for the camera account | A password leaked elsewhere cannot be reused here |
| Keep camera firmware and the app updated | Patches close known flaws |
| Secure the router and check it for updates | Every camera on your network sits behind it |
| Review who has shared access to the account | Old shared users keep their access until removed |
| Keep indoor cameras out of bedrooms and bathrooms, or use privacy mode | Limits what any breach could expose |
For the most control, some owners run cameras on a local system with no maker cloud at all. That takes more setup; the options are in Home Assistant security systems. Cameras that record to storage you own without a subscription are listed in no-subscription security cameras.
Frequently asked questions
- Can someone hack my Ring camera?
- It has happened. The FTC's 2023 complaint says hackers exploiting account vulnerabilities, including credential stuffing with reused passwords, reached videos, live streams and account profiles of about 55,000 US Ring customers. Ring's order requires multifactor authentication for customer accounts; keep it on and use a password you do not use anywhere else.
- Are Eufy cameras safe to use?
- New York's Attorney General found in 2025 that some Eufy video was not end-to-end encrypted in transit, and the settlement requires the US distributors to show that Eufy's developer encrypts video and runs a vulnerability management program. We cannot say whether current models are secure; we report the documented record and the settlement terms only.
- Is local storage safer than cloud?
- It keeps footage off company servers, which removes the employee-access and cloud-breach risks. It does not remove app and network risks, since most local cameras still connect to the maker's servers for remote viewing.
- How can I tell if a camera gets security updates?
- If a product carries the FCC's U.S. Cyber Trust Mark, its QR code links to a registry that shows whether updates are automatic and the product's minimum support period. Otherwise, check the maker's support pages for firmware release notes.
Sources
- FTC May 31, 2023: Ring allowed any employee or contractor to access consumers' private videos; hackers used account vulnerabilities to access stored videos, live streams and profiles of approximately 55,000 US customers; credential-stuffing attacks in 2017 and 2018; MFA not implemented until 2019; proposed order $5.8 million consumer refunds; privacy and security program with MFA for employee and customer accounts; credential stuffing definition: https://www.ftc.gov/news-events/news/press-releases/2023/05/ftc-says-ring-employees-illegally-surveilled-customers-failed-stop-hackers-taking-control-users (accessed 2026-10-01)
- NY AG January 28, 2025: $450,000 from Fantasia Trading, Power Mobile Life and Smart Innovation (eufy distributors); video in certain situations not end-to-end encrypted and part of the connection unencrypted; streams accessible to anyone with the link; settlement requires encryption in storage and transit, vulnerability management program: https://ag.ny.gov/press-release/2025/attorney-general-james-secures-450000-companies-selling-home-security-cameras (accessed 2026-10-01)
- Wyze statement February 2024: outage originated from partner AWS; about 13,000 users received thumbnails from cameras not their own; 1,504 tapped; in some cases an event video could be viewed; caused by a third-party caching client library; added a new layer of verification before users connect to event videos: https://forums.wyze.com/t/update-on-investigation-of-2-16-24-security-issue/291002 (accessed 2026-10-01)
- FTC August 30, 2024: Verkada March 2021 breach gave a hacker access to over 150,000 live customer cameras; order requires comprehensive information security program with third-party audits; $2.95 million penalty for CAN-SPAM violations: https://www.ftc.gov/news-events/news/press-releases/2024/08/ftc-takes-action-against-security-camera-firm-verkada-over-charges-it-failed-secure-videos-other (accessed 2026-10-01)
- FCC U.S. Cyber Trust Mark: voluntary cybersecurity labeling program for wireless consumer IoT products including internet-connected home security cameras; QR code links to registry with support period and whether updates are automatic: https://www.fcc.gov/CyberTrustMark (accessed 2026-10-01)
- FTC consumer advice: secure the router and check for updates; use two-factor authentication where offered; update device firmware and apps regularly: https://consumer.ftc.gov/articles/securing-your-internet-connected-devices-home (accessed 2026-10-01)
Related guides
- CryWolf Alarm Registration: What It Is and Who Uses It Many cities run alarm permits through CryWolf. What it is, how registration and false alarm billing work, and which cities publish it.
- Do Burglars Return to the Same House? The Repeat Burglary Evidence Repeat burglary is real and fast: research finds most repeats happen within weeks. What the DOJ-funded studies show, and how strong the US evidence is.
- Do Fake Security Cameras Work? What the Evidence Says What burglar-interview studies and crime research say about dummy cameras, and what a real budget camera costs instead.
- Do Security Signs Actually Deter Burglars? The Evidence What burglar surveys and victimization data actually show about yard signs, alarm decals, and dummy alarms as deterrents. The honest evidence, with sources.
- Do Video Doorbells Deter Burglars? The Published Evidence What police data and published studies say about video doorbells and burglary or package theft, and where the evidence is thin.