Hack of video security company Verkada exposes footage from 150,000 connected cameras

Video and AI security company Verkada was breached, giving hackers access to over 150,000 internet-connected security cameras that were being used inside schools, jail cells, hospital ICUs, and major companies like Tesla, Nissan, Equifax, Cloudflare and others.

The hack was conducted by a loose-knit anti-corporate hactivist group called APT-69420, based in Switzerland. According to the group’s representative Till Kottmann, they accessed Verkada’s systems on March 8 and the hack lasted for 36 hours. She described Verkada, a Silicon Valley-based startup, as a “fully-centralized platform” which made it easy for her team to access and download footage from thousands of security cameras. The leaked footage appears to include major companies and institutions, but not private homes.

The video and images purport to capture a range of activities that might be sensitive, like security video from the Tesla car manufacturing line and a screenshot from inside the security firm Cloudflare. Some of the material is highly personal, including video of patients in hospital intensive care units and prisoners inside the Madison County Jail in Huntsville, Alabama.

Kottman described the security on Verkada systems as “nonexistent and irresponsible,” and said her group targeted the company to demonstrate how easy it is to access internet-connected cameras placed in highly sensitive locations.

Verkada said they notified their customers about the hack, and that their security teams are working with an external security firm to investigate it. Verkada told CBS News, “We have disabled all internal administrator accounts to prevent any unauthorized access. Our internal security team and external security firm are investigating the scale and scope of this issue, and we have notified law enforcement.”