Breach / exposure

Flock Safety sent an email to Connecticut police departments warning of a security incident. A malicious actor published a website showing the location of more than 300,000 Flock devices. Flock said the data was unlawfully accessed from a third-party map service and that no images, video or sensitive law enforcement data was exposed. Ledyard Police Chief Ken Cruetz asked the town council to sever the contract. Records show Flock knew about the vulnerability for almost nine months but did not notify customers until the website appeared.

Hackers from a collective calling itself stegan0gram removed a Flock Safety camera above a roadway, copied its storage, and recovered an encryption key stored on the device. The recovered logs and videos showed the device captured 1.6 million images of 50,000 vehicles in 21 days, and its software explicitly detects people as well as vehicles, license plates, and bicycles.

Security researchers Jon Gaines and Benn Jordan demonstrated that a physical button sequence on Flock Safety cameras activates a diagnostic Wi-Fi hotspot, often protected by the default password “security.” This allows root access via Android Debug Bridge in under 30 seconds, enabling footage extraction, malware installation, and credential theft. Additionally, over 60 Flock cameras were found streaming live footage with no authentication, exposing 30 days of archived video. Flock operates over 100,000 license plate readers across the U.S.

In March 2026, a report stated that stolen police logins are exposing Flock Safety’s automated license plate readers to hackers. A DEA agent was found to have used a local officer’s password to access the camera system without authorization. Flock Safety lacks robust internal protections, and many agencies fail to enforce multi-factor authentication. Lawmakers are demanding immediate accountability and reform. Data from these cameras covers approximately 70% of Americans, raising privacy and security concerns.

An automated license plate reader system flaw in Ventura County, California, allowed federal and out-of-state agencies to query local ALPR data in violation of state law. The Ventura County Sheriff’s Office audited the system on Feb. 11 and found over 364,000 searches by out-of-state agencies between Feb. 19 and March 19, 2025. Other agencies reported similar access: Port Hueneme logged 798,000 out-of-state queries, Oxnard two, Ventura two. The feature called ‘National Lookup’ had been inadvertently enabled. Oxnard suspended its Flock system; others continued using it with new safeguards.

Flock Safety confirmed a data breach that exposed live video from a limited number of its Condor cameras to the internet, allowing unauthorized viewing, access to about a month of archived footage, and deletion of video. The breach was discovered by YouTuber Benn Jordan, who found publicly accessible camera feeds. Flock said the exposure came from tests for carrier compatibility and that it was corrected with security updates. Vero Beach Police Department, in Florida, confirmed it uses the cameras but said it wasn’t impacted.

On January 13, 2026, the Santa Cruz City Council voted 6–1 to terminate the city’s contract with Flock Safety, ending use of the company’s automated license plate readers. The termination takes effect after a 30-day notice, possibly as early as February 12. Councilmember Sonja Brunner voted against. The motion followed data breaches, community pushback, and a recommendation from three councilmembers. It also directed staff to explore future installation of similar technology with stronger privacy safeguards.

404 Media reported that at least 60 of Flock Safety’s AI-enabled Condor cameras were exposed to the open internet, allowing anyone to watch live feeds, download 30 days of video archives, and change settings without any password or login. The exposed cameras included views of playgrounds and parking lots. Flock Safety said the flaw was a limited misconfiguration on a small number of devices and has since been remedied. The affected Condor Live cameras are not the same model as the license-plate reader cameras used by San Francisco and Oakland police.

In late December 2025, technologist Benn Jordan and security researcher Jon “GainSec” Gaines found Flock Condor PTZ cameras exposed on the public internet. 404 Media reported that at least 60 Condor cameras were live-streaming without any authentication, along with 30 days of archived video; the feeds and admin interfaces were unencrypted and required no username or password. The access could have allowed changing camera settings, running diagnostics, viewing logs, deleting videos and remotely controlling the cameras. A 404 Media reporter watched himself on a live feed from his phone while standing in the street, and colleagues hundreds of miles away viewed the same link. Gaines reported finding 67 live feeds and debug web interfaces. Straight Arrow News reported one exposed camera captured children on a playground. No public remediation cost was reported.

Sen. Ron Wyden and Rep. Raja Krishnamoorthi sent a letter to the Federal Trade Commission urging an investigation into Flock Safety for not requiring multi-factor authentication on its license-plate camera platform. The lawmakers said stolen police logins had been shared online and a Russian cybercrime forum allegedly sold access to Flock logins. Flock said it enabled MFA by default for new customers in November 2024 and that 97% of its law enforcement customers have enabled it.

Security researcher Matt Brown found that more than 150 Motorola ALPR cameras were misconfigured and exposed live video feeds and vehicle data on the public internet without authentication. WIRED confirmed the exposure by analyzing data streams from 37 IP addresses across over a dozen U.S. cities, capturing nearly 4,000 vehicles in 20 minutes. Motorola Solutions confirmed the exposures and said it was working with customers to restore configurations and would add security hardening in a firmware update.

In January 2025, a security researcher bought a Motorola ReaperHD license-plate-reader camera on eBay and found that many identical live cameras were misconfigured to stream colour video, infrared video and vehicle data including plate numbers to the open internet, viewable in real time with no username or password. The researcher used text from a 404 error page to locate exposed devices; more than 150 appeared in a public internet-scanning tool, and roughly 170 unencrypted ALPR streams were reported found. A tool published on GitHub logs plates, make, model and colour from exposed cameras to a CSV with a vehicle image. Motorola confirmed the exposures and said it was working with affected customers to close the open access. The ReaperHD is a legacy device whose sales were discontinued in June 2022. No public remediation cost was reported.

In June 2019, U.S. Customs and Border Protection subcontractor Perceptics was breached in what CBP called a malicious cyberattack. Images of travellers’ faces and license plates, contracting documents and other data were made publicly available on the internet. About 184,000 traveller images from CBP’s facial-recognition pilot were compromised, and at least 19 were posted to the dark web. The attackers also obtained contractual documents, program-management documents, emails, system configurations, schematics and implementation documentation related to CBP license-plate-reader programs. Perceptics had downloaded sensitive CBP data from an unencrypted device and transferred it to the company’s network, violating DHS security requirements. Perceptics was suspended from federal contracts, subcontracts, grants and loans in June 2019; the suspension was lifted in September 2019. A September 2020 DHS Inspector General report found CBP did not adequately safeguard the data, though no federal networks were compromised.