Verkada camera platform access via exposed admin credentials
In March 2021 intruders used an administrator-level username and password left exposed online to enter Verkada's systems, gaining access across the company's customer camera platform, including live feeds at hospitals, factories and a jail. The FTC later alleged Verkada failed to use appropriate security measures, and settled with the company in August 2024.
- Victim
- Verkada
- Industry
- Technology
- Country
- United States
- Intrusion began
- Mar 2021
- First disclosed
- Mar 9, 2021
- Actor
- Unattributed
- Initial access
- Exposed secrets
- Identity control that failed
- Authorization
- MFA
- Not disclosed
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- $3 million (Civil penalty in the 2024 FTC and DOJ settlement; it was tied to CAN-SPAM violations, not the security incident itself.)
The identity lesson
Support super-admin accounts that span every tenant need MFA, just-in-time access and secret scanning; one leaked credential should never reach every customer.
Regulatory and legal outcome
August 30, 2024: FTC and DOJ settlement requiring a security program and independent assessments, with a $2.95 million civil penalty for CAN-SPAM violations. Verkada neither admitted nor denied the allegations.
Sources
- CCTV biz Verkada pays $3M to settle FTC complaint, The Register, Sep 5, 2024
- $2.95M Penalty and Permanent Injunction Resolves Lawsuit Against Verkada Inc. for Alleged Unlawful Commercial Emails, Data Security Failures and Deceptive Practices, U.S. Department of Justice, Aug 30, 2024
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- LiteLLM poisoned PyPI and Docker release traced to a leaked, never-revoked admin key 2026 · Exposed secrets
- Internet Archive user database theft and Zendesk token abuse 2024 · Exposed secrets
- Microsoft AI research SAS token exposed 38 TB of internal data 2023 · Exposed secrets
- Codecov Bash Uploader compromise via credential extracted from Docker image 2021 · Exposed secrets
Cite this record
SWI Community Team. (2026). Verkada camera platform access via exposed admin credentials. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2021-verkada-super-admin-credentials/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.