I've had a head cold all week that's made my brain run about half speed, which is my excuse for getting to this a few days late. But I've been chewing on the Verkada story since Bloomberg broke it on Tuesday and I want to get it down before the next thing eats the news cycle.
Quick recap for anyone who missed it: Verkada is a Silicon Valley startup that sells internet-connected security cameras to businesses, the kind of sleek white boxes you see mounted in office lobbies now instead of the old grainy CCTV units. They raised a $130 million round back in January at a $1.6 billion valuation, so this is not some scrappy nobody outfit. A group of hackers got into Verkada's systems using a "super admin" account and from there got live access to something like 150,000 camera feeds. Tesla factory floors. Cloudflare's own offices. Equinox gyms. A women's clinic. A psychiatric hospital. A jail in Alabama, where the footage reportedly showed inmates being interrogated by officers.
The part that stuck with me isn't even the scale, though 150,000 is a genuinely absurd number to sit with. It's who did it and why they say they did it. The person who came forward, a Swiss security researcher named Tillie Kottmann, is part of a loose group calling itself "APT-69420 Arson Cats" (yes, really), and when asked by Bloomberg why they did it, the answer was something like curiosity, a belief in freedom of information, a dislike of surveillance capitalism, and, in their words, a lot of fun. I keep going back and forth on how I feel about that framing. Breaking into a psychiatric hospital's camera feed doesn't feel like a noble act of transparency to me no matter how it's dressed up, and reportedly there was video going around of a Verkada staffer laughing while browsing through customer feeds like it was a screensaver. That part isn't a hacktivist statement, that's just gross.
What actually got me thinking, though, is how boring the vulnerability was. This wasn't some elegant zero-day. From what's being reported, they found a username and password for a super-admin account sitting exposed on the internet and just logged in. That's it. A company selling cameras specifically marketed as more secure than the old analog stuff, valued at over a billion and a half dollars, got taken down by credential hygiene that any of us would get dinged for in a code review.
I'll admit this made me go check my own setup, and I was not thrilled with what I found. I've got a couple of cheap Wyze cams in the house, mostly pointed at the front door and the spot where the dog likes to destroy things when we're not home, and I genuinely could not remember the last time I'd rotated the password on the account tied to them. Changed it right there on the couch, cold and all. If a well-funded startup with actual security engineers on staff can leave the front door open, my $25 camera from three years ago is not exactly Fort Knox.
There's a broader thing here that I don't think gets said enough, which is that "the cloud" for a lot of these devices just means somebody else's login screen, and that login screen is only as good as whoever's maintaining it that week. We've spent the last decade wiring cameras into hospitals and schools and jails on the promise that it makes things safer, and functionally what we've built is a single point of failure that, when it fails, doesn't just leak your Spotify playlist, it leaks a live view into a psych ward. I don't have a tidy fix for that. Regulation on this stuff is a mess and always lags the technology by years, and "just use better passwords" is true but also the kind of advice nobody follows until it's their own feed on the front page of a tech blog.
Microsoft's Exchange Server mess has been eating most of the security oxygen this month and for good reason, it's a much bigger and messier story with a lot more moving parts, so I've mostly stayed quiet on it since it feels like every outlet with a keyboard has already said their piece. But Verkada is the one that actually changed something about how I behave this week, which counts for more in my book than another headline about nation-state actors I have no ability to do anything about.
Going back to bed. This cold is not messing around.