A poultry farmer in northern Israel noticed something strange: the interface on his Chinese-made chicken coop camera had switched to Arabic. Israel’s National Cyber Directorate traced it to Iranian-linked actors, according to Wall Street Journal reporting, who had taken control of the device and used its field of view to observe Israeli security forces near the Lebanon border.
Nobody broke down a door. Nobody bypassed military-grade encryption. The attackers simply logged in using credentials the device had shipped with and that no one had changed.
That is the story. Not that cameras get hacked. S-RM, a cybersecurity consultancy, estimates roughly 1.2 billion cameras are connected to the internet worldwide, and a significant portion shipped with security that was, at best, an afterthought.
Cameras Have Become the Cheapest Intelligence Asset in Any Conflict
When a chicken coop camera can surveil a border, the battlefield has no fixed perimeter.
Ukraine-supporting hackers from Team OneFist took control of a camera in Sevastopol, rotated it across the Black Sea, and tracked a Russian military helicopter to what they described as a previously unknown air base, according to Wall Street Journal reporting on the group’s operations. Ukrainian forces later struck the site, damaging aircraft and air-defense systems, according to that same reporting. The group also reportedly monitored cameras near the Kerch Strait Bridge to help refine attack planning.
Russian actors ran a comparable operation in reverse. The Dutch intelligence services AIVD and MIVD warned in a July 2026 advisory that Russian state actors systematically compromised cameras across Europe, the Netherlands, other EU and NATO states, and Ukraine to gather intelligence on weapons-delivery routes and the movements of Ukrainian military personnel.
Ukraine’s Security Service said it identified, secured, or blocked roughly 40,000 cameras deemed security risks after Russia’s full-scale invasion began. Israeli officials said Iranian-linked groups compromised more than 250 sensitive cameras inside Israel, including license-plate readers and cameras positioned near military outposts and gathering points, according to Wall Street Journal reporting.
Alexander Leslie of Recorded Future characterized the trend as the conversion of civilian surveillance into wartime intelligence collection, according to Wall Street Journal reporting. Dutch intelligence reporting confirms that compromised cameras have provided adversaries with intelligence on military logistics, weapons deliveries, and personnel, without requiring a spy, a drone, or a satellite.
The Industry Keeps Shipping the Problem
Convenience was the product. Security was the afterthought nobody invoiced for.
Palo Alto Networks research found that webcams and digital video recorders make up a large share of weakly secured internet-connected devices. The reason is structural. Cameras are often installed by facilities or operations teams working outside formal security processes, powered on, connected to the network, and left with minimal monitoring or maintenance.
The specific failures the industry has the technical capacity to correct:
- Default credentials that ship on devices and are rarely changed by users
- Firmware update pipelines that slow or stop entirely after a product launches
- Remote-access features such as peer-to-peer and UPnP enabled by default without clear disclosure
- No network segmentation guidance included in standard consumer setup documentation
- Short or undisclosed support lifecycles that leave devices permanently unpatched
AI compounds the exposure further. Automated scanning finds vulnerable cameras at scale. The AIVD and MIVD advisory confirmed that attackers use automated image-recognition tools to search footage for military vehicles, cargo, and personnel, surfacing useful intelligence without manually reviewing every frame.
What Accountable Manufacturers Would Actually Do
The tools to fix this exist. The business case to ship them that way has been missing.
Camera makers can require unique credentials at first setup rather than relying on users to change factory defaults. They can publish clear end-of-support dates, disable remote-access features by default, and build firmware update prompts that users cannot permanently dismiss.
Cloud-video providers can flag anomalous login behavior. Retailers can set minimum security baselines as a condition of stocking a product.
On the consumer side: change default passwords, apply firmware updates promptly, isolate cameras on a separate network segment, and take an honest look at what your camera can actually see from where it sits. For a broader overview of vetted options, see our guide to home security systems experts recommend.
The technology to make cameras secure by default already exists. What has been absent is the business incentive to ship them that way. Regulators in several jurisdictions are already considering or adopting IoT security requirements. The industry’s choice is whether to get ahead of that pressure or wait for a breach consequential enough to force the conversation.
