Loading story…
Consumer CCTV and smart camera systems, widely adopted for home security, present significant privacy and security risks. In several documented cases, criminals have accessed CCTV footage by exploiting weak or stolen passwords, sometimes purchased cheaply from public databases, allowing them to obtain sensitive video recordings before victims are even aware of a crime. These incidents highlight that while cameras can deter theft and provide evidence, they also create new vulnerabilities if not properly secured, raising concerns about who truly controls access to surveillance data.
Beyond the risk to device owners, smart cameras and doorbells routinely capture footage of bystanders—neighbors, visitors, and passersby—without their knowledge or consent. A recent study found that most major vendors of these devices do not adequately address bystander privacy in their policies, often placing the responsibility on device owners rather than taking proactive steps to protect non-users. Legal frameworks like GDPR and CCPA offer limited guidance for recordings made on private property, leaving significant gaps in privacy protection for individuals inadvertently caught on camera.
See the reporting duties and controls this puts on the clock.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A Mysterium VPN investigation found more than **3 million** internet-reachable cameras and recorders online, including **21,786 devices** that were streaming live video with **no authentication required**. Researchers said the exposure was driven primarily by low-cost and legacy products rather than active exploitation, with `RTSP` representing the largest share of openly accessible video and accounting for **9,746** unauthenticated feeds. The report also noted that the researchers did not attempt default or weak passwords, indicating the number of reachable devices could be even higher. The most heavily exposed systems were tied to budget and older platforms, including webcamXP and HiSilicon-class recorders, while major vendors such as **Hikvision** and **Dahua** were rarely exposed because of mandatory password setup policies. **Japan** and the **United States** accounted for more than a third of the open feeds, largely on residential broadband networks, raising privacy and physical security concerns as strangers could watch activity inside homes and other sensitive spaces. Recommended mitigations included setting strong passwords, disabling `UPnP`, limiting unnecessary `RTSP` exposure, updating firmware, and removing unmaintained devices from direct internet access.
Jun 29, 2026
Voice assistants and other smart home devices are generating detailed records that can later be accessed by companies or sought by law enforcement, raising concerns that everyday household technology may become a source of criminal evidence. Reporting highlighted that devices such as Amazon Alexa continuously collect behavioral, audio, and usage data, with wake-word systems capable of false activations that may cause unintended recordings to be uploaded for cloud processing and retention. The coverage pointed to U.S. criminal investigations in Arkansas, Florida, and New Hampshire in which Amazon Echo data was sought or used, underscoring how cloud-stored smart home records can become subpoenaable evidence. It also warned that smart TVs, robot vacuums, smart locks, Fitbits, and even connected water meters can create searchable logs of daily life, and urged users to reduce exposure by inventorying connected devices, limiting unnecessary internet connectivity, understanding whether devices are truly powered off, and keeping at least one room free of smart technology.
Aug 11, 2026
A critical vulnerability, tracked as CVE-2025-13607, has been identified in multiple CCTV camera products, including those from D-Link India Limited, Sparsh Securitech, and Securus CCTV. The flaw arises from missing authentication for a critical function, allowing remote attackers to access sensitive camera configuration data and administrative account credentials simply by exploiting a vulnerable URL endpoint. The vulnerability is network-accessible, requires no user interaction or special privileges, and has been assigned a CVSS v4 score of 9.3 and CVSS v3 score of 9.4, indicating its severe risk to surveillance infrastructure. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert regarding this issue, and D-Link has released security updates for affected devices, urging immediate patching and verification of firmware versions. Successful exploitation of this vulnerability could enable attackers to hijack video feeds, steal credentials, and potentially compromise entire surveillance systems. The D-Link DCS-F5614-L1 camera model running firmware versions v1.03.038 and earlier is confirmed to be affected, while other models from Sparsh Securitech and Securus CCTV may also be vulnerable. Organizations using these products are strongly advised to apply available patches and review their camera deployments for exposure. The flaw's trivial exploitation path and the sensitive nature of the data at risk make prompt remediation critical for maintaining the integrity and confidentiality of video surveillance operations.
Jun 29, 2026