Hackers say they breached Verkada, accessing feeds and archives of 150K surveillance cameras inside clinics, police precincts, jails, schools, Tesla facilities

- Hacker group says it wanted to show prevalence of surveillance — Video footage was captured from Sequoia-backed startup Verkada

Bloomberg 2021-03-10 William Turton

Context & Ripple Effects

The reported intrusion lands after allegations that Verkada staff had used the company’s own cameras to monitor and harass coworkers, exposing governance risks alongside technical ones. Related coverage then described widely shared super-admin access among more than 100 Verkada employees, making the breach part of a broader question over who can reach customers’ video systems.

For customers across clinics, police precincts, jails, schools and Tesla facilities, the incident turns a centralized surveillance service into a shared exposure point rather than a set of isolated camera deployments.

First-order effects

Verkada and affected customers must treat both live feeds and stored archives as potentially exposed, with the immediate impact spanning sensitive locations rather than a single organization.
The alleged breach intensifies scrutiny of Verkada’s internal controls, particularly given reports of employees misusing company camera access before the incident.

Second-order effects

Customers evaluating Verkada must weigh the operational convenience of centralized camera management against the blast radius created when administrative access is compromised.
Security-camera vendors face pressure to distinguish their access-control and employee-oversight practices as buyers reassess vendor-managed video archives.

Third-order effects

If centralized surveillance platforms continue to combine broad customer access with weak internal guardrails, procurement will increasingly treat video-system governance as a core security requirement, not merely a feature comparison.
The pattern joins earlier breaches of policing-data providers such as Securus, showing how services built around sensitive monitoring data can become high-value concentration points.

The trend: Surveillance technology is becoming a data-governance risk category, as centralized access to cameras and archives concentrates both external and insider exposure.

Discussion

@williamturton William Turton on x
SCOOP: Hackers have breached Verkada, a security camera company. Hackers were able to access LIVE FEEDS of 150,000 cameras from Tesla, Cloudflare, schools, hospitals, prisons, and thousands of other organizations. https://www.bloomberg.com/...
@josephfcox Joseph Cox on x
New: obtained the list of customers of facial recognition company Verkada from the hackers. Filtering provides over 24,000 unique entities. The spread of these cameras that come preloaded with facial recognition is truly staggering when laid out like this https://www.vice.com/...…
@nyancrimew Tillie Crimew on x
ever wondered what a mainenance backdoor root shell inside the Cloudflare or Telsa HQs would look like? three clicks in a browser to get here with the right kind of account on the right webapp. APT-69420 ArsonCats #OperationPanopticon https://twitter.com/...
@williamturton William Turton on x
about to publish one of the craziest stories ive ever worked on
@em0ntw1tter @em0ntw1tter on x
“Verkada employees abused their own surveillance cameras installed in the company office to harass coworkers, including joking about women colleagues identified by the cameras and making sexually explicit jokes about them. Initially, the company did not fire the respective...”👇 h…
@williamturton William Turton on x
Another video, shot inside a Tesla warehouse in Shanghai, shows workers on an assembly line. The hackers said they obtained access to 222 cameras in Tesla factories and warehouses. https://www.bloomberg.com/...
@jjjollyjim Jamie on x
“At Verkada, we protect your data during transit and at rest in the cloud. We own the data pipeline end-to-end, so potential assailants have no publicly available means of entry, such as an insecure API.”
@evacide Eva on x
Ubiquitous surveillance is bad. Poorly-secured ubiquitous surveillance is even worse. #verkada https://www.bloomberg.com/...
@tomgara Tom Gara on x
I know it's unfashionable to be surprised by bad things, but I'm genuinely surprised so many companies would install security cameras inside their facilities that can be remotely logged into by staff at the company that makes the cameras https://www.bloomberg.com/...
@lisaabeyta Lisa Abeyta on x
Every startup's nightmare. Nothing is 100% secure, but this is bad. I don't know how you recover from publicly visible breaches with that many high profile clients early on when you're trying to gain traction. https://twitter.com/...
@alexhcranz @alexhcranz on x
Verkada is screwed for such bad security, but the invasive level of surveillance demanded by its customers feels even worse? https://twitter.com/...
@robcrilly Rob Crilly on x
Jail's, gyms, schools (including Sandy Hook) - by international collective of hackers wanting to show the invasive proliferation of security cameras https://twitter.com/...
@williamturton William Turton on x
In a video seen by Bloomberg, a Verkada camera inside Florida hospital Halifax Health showed what appeared to be eight hospital staffers tackling a man and pinning him to a bed. https://www.bloomberg.com/...
@mattdrange Matt Drange on x
“Some of the cameras, including in hospitals, use facial-recognition technology to identify and categorize people captured on the footage. The hackers say they also have access to the full video archive of all Verkada customers.” https://www.bloomberg.com/...
@fabiochiusi Fabio Chiusi on x
“A hacked customer list shows that facial recognition company Verkada is deployed in tens of thousands of schools, bars, stores, jails, and other businesses around the country” https://www.vice.com/...
@williamturton William Turton on x
The hackers say they also gained access to the security cameras of Sandy Hook Elementary School in Newtown, Connecticut, where a gunman killed more than 20 people in 2012. https://www.bloomberg.com/...
@threatresearch Andrew Brandt on x
Astonishing to me that, in this day and age, anyone trusts a cloud-based video capture solution. Any of them. If you want to keep your pervasive panopticon CCTV recordings secret, keep it on-prem and lock that server down. That said, holy moly, this is bad. https://twitter.com/..…
@josephfcox Joseph Cox on x
Unclear whether every one of these 24,000 entities are actively using the facial recognition features of Verkada's cameras. But they come prebaked with that capability. https://www.vice.com/... https://twitter.com/...
@nyancrimew Tillie Crimew on x
ever wondered what an @Tesla warehouse looks like? APT-69420 Arson Cats #OperationPanopticon https://twitter.com/...
@k8em0 Katie Moussouris on x
“hackers' methods were unsophisticated: they gained access to Verkada through a “Super Admin” account, allowing them to peer into the cameras of all of its customers. Kottmann says they found a user name and password for an administrator account publicly exposed on the internet.”…
@bradstone Brad Stone on x
Must-read story from @WilliamTurton and the @technology cybersecurity team that illustrates the risks and potential abuses of ubiquitous surveillance technology https://twitter.com/...
@troyhunt Troy Hunt on x
😲😲😲 “the group managed to gain Super Admin-level access to Verkada's system using a username and password they found publicly on the internet. From there, they were able to access the entire company's network, including root access to the cameras” https://www.theverge.com/...
@erratarob @erratarob on x
Your regular reminder that security cameras are insecurity cameras. https://www.theverge.com/...
@kimzetter Kim Zetter on x
Per Verkada's website all of its cameras include facial recognition tools. The cameras can detect “meaningful events” and “unusual motion.” After detecting faces, “a...web app allows the camera's admin to search over time for footage that includes that specific person.” https://t…
@evacide Eva on x
Hey, doesn't Verkada sound familiar? Last time they were in the news it was for this: https://twitter.com/...
@jimmyjenkins Jimmy Jenkins on x
“Inside Arizona's Graham County detention facility, which has 17 cameras, videos are given titles by the center's staff and saved to a Verkada account.” “Hackers also say they watched cameras at Tempe St. Luke's Hospital, in Arizona” https://www.bloomberg.com/...
@business @business on x
EXCLUSIVE: Hackers broke into thousands of security cameras, accessing live footage from inside hospitals, prisons, and even a Tesla factory https://www.bloomberg.com/...
@williamturton William Turton on x
SCOOP: Hackers have breached Verkada, a security camera company. Hackers were able to access LIVE FEEDS of 150,000 cameras from Tesla, Cloudflare, schools, hospitals, prisons, and thousands of other organizations. https://www.bloomberg.com/...

Chronicles