On 8 and 9 March 2021, attackers broke into the cloud platform of Verkada, a US maker of internet-managed security cameras, and viewed live and archived video from customer sites. Bloomberg reported the breach on 9 March. The hacking group, which included Swiss hacker Tillie Kottmann, claimed access to 150,000 cameras at companies such as Tesla and Cloudflare, hospitals, jails and schools, through a "Super Admin" account whose username and password they found exposed online. Verkada's own investigation, published in April 2021, says the entry point was a misconfigured, internet-facing Jenkins server used by its support team, which held admin-level credentials for running support scripts. With them the attackers logged into an internal support interface. Verkada says 97 customers had cameras accessed and video or images viewed, out of about 6,000. It cut off access within two hours of learning of the breach. In 2024 Verkada agreed a $2.95 million settlement with the US Federal Trade Commission.
Key takeaways
- Verkada says attackers entered through "a misconfigured customer support server exposed to the internet", a Jenkins server that held admin-level credentials for running support scripts.
- Those support credentials gave access to an internal support interface with reach into customer accounts, which the hackers described as "Super Admin" access.
- Verkada counts 97 customers whose cameras were accessed and video or images viewed, eight with Access Control data including badge credentials, and eight with Wi-Fi credentials accessed; the hackers claimed 150,000 cameras.
- Verkada cut off access within two hours of learning of the breach on 9 March 2021 and disabled all internal administrator accounts; it attributes the attack to Tillie Kottmann, who was indicted in the US on separate charges on 18 March 2021.
- The identity lesson: a support tool's standing admin credential is a key to every customer, so it must be vaulted, scoped, short-lived and never left on an internet-facing server.
At a glance
| Organisation | Verkada Inc. and its customers, including Tesla, Cloudflare, hospitals, schools, jails and police departments named in reporting |
|---|---|
| When | 8 to 9 March 2021; reported by Bloomberg on 9 March 2021; Verkada incident report published 7 April 2021 |
| Attacker | A hacking collective including Tillie Kottmann, to whom Verkada attributes the attack |
| Entry point | A misconfigured, internet-facing Jenkins server used by Verkada's customer support team |
| Identities abused | Customer support administrator credentials stored on the server for executing support scripts, giving super-admin-level access to customer accounts |
| Impact | 97 customers' cameras accessed and video or images viewed, Access Control and Wi-Fi credentials accessed for some customers, user list downloaded (Verkada figures); 150,000 cameras claimed by the hackers |
| Category | NHI. Incident class: confirmed NHI breach (support script credentials on an exposed server used to access customer cameras) |
What happened
Verkada sells security cameras, access control systems and sensors that customers manage through its cloud platform, Command. On 9 March 2021 Bloomberg reported that a hacking collective had gained access to live feeds of 150,000 cameras inside hospitals, companies, police departments, prisons and schools. According to Bloomberg, as republished by Al Jazeera, "Kottmann says they found a user name and password for an administrator account publicly exposed on the internet," and the group used it to reach Verkada through a "Super Admin" account. The hackers said they reached 222 cameras in Tesla factories and warehouses, Cloudflare offices and 330 cameras in the Madison County Jail in Alabama. Kottmann described the motive as "lots of curiosity, fighting for freedom of information and against intellectual property".
Verkada's response that day was to cut off administrator access: "We have disabled all internal administrator accounts to prevent any unauthorized access," the company said. Its incident report, written by its CISO and CTO with forensic support from Mandiant, explains how the access worked. "The attackers' vector of entry was through a misconfigured customer support server exposed to the internet." The support team used an internet-facing Jenkins server for common support tasks, and "The customer support server contained admin-level credentials for executing support scripts." The attackers found those customer support administrator credentials and used them to log into a support web interface, and from there into customer accounts through internal support functions.
Verkada says the attack ran from 8 to 9 March, that it learned of it at about 18:00 UTC on 9 March and that it cut the attackers off within two hours. Its counts are smaller than the hackers' claim: "In all, 97 customers had their cameras accessed and video or image data viewed." The attackers reached 68 customer organisations through the Command interface, where 4,530 cameras may have been accessed, and sent remote shell commands to 25 cameras in six organisations. Eight customers had Access Control data accessed, including badge credentials, and eight had Wi-Fi credentials accessed. The attackers also downloaded a list of Command users with names and email addresses but no passwords. Verkada says this was less than two percent of its roughly 6,000 customers, and that it found no evidence of access to AWS credentials, its wider network or source code.
US prosecutors announced an indictment of Till Kottmann on 18 March 2021 for conspiracy, wire fraud and aggravated identity theft over alleged thefts of source code and data from many organisations. The release does not name Verkada, and Kottmann is presumed innocent unless proven guilty. In 2024 the FTC announced a proposed order, subject to court approval, requiring Verkada to run a comprehensive information security programme and pay a $2.95 million penalty for separate CAN-SPAM violations. Verkada said, according to Infosecurity Magazine: "We do not agree with the FTC's allegations, but we have accepted the terms of this settlement."
Timeline
| Date | Event |
|---|---|
| 8 March 2021 | Attackers begin using support credentials from Verkada's exposed Jenkins server, according to Verkada. |
| 9 March 2021 | Bloomberg reports the breach; Verkada learns of it at about 18:00 UTC, cuts off access within two hours and disables internal administrator accounts. |
| 12 March 2021 | Swiss authorities execute search warrants in the Kottmann case, according to the US Department of Justice. |
| 18 March 2021 | The US Attorney's Office in Seattle announces Kottmann's indictment on separate charges. |
| 7 April 2021 | Verkada publishes its incident report; later revisions on 23 April and 21 May 2021 update the figures. |
| 2 September 2024 | Infosecurity Magazine reports the FTC's proposed order and $2.95 million penalty. |
How it happened: the identity attack path
- Exposed support server. Verkada's support team ran a Jenkins server that was reachable from the internet and misconfigured.
- Stored admin credentials. The server held admin-level credentials used to execute support scripts, a standing machine credential with reach across customer accounts.
- Support interface login. The attackers used those credentials to log into Verkada's customer support web interface, gaining what they called "Super Admin" access.
- Access to customer systems. Through support functions they viewed camera feeds and archives, accessed Access Control data, badge and Wi-Fi credentials, and sent shell commands to 25 cameras.
- Revocation. Verkada revoked access within two hours of detection and disabled all internal administrator accounts.
Impact
- Confirmed by Verkada: 97 customers had cameras accessed and video or images viewed; 68 organisations were reached through Command with up to 4,530 cameras potentially accessed; eight customers had Access Control data accessed and eight had Wi-Fi credentials accessed; a list of Command users was downloaded.
- Claimed by the hackers: access to live feeds of 150,000 cameras, including 222 at Tesla and 330 at an Alabama jail. Verkada's figures do not support the 150,000 number.
- Not affected, according to Verkada: AWS credentials, source code, financial and other business systems, and user passwords.
- Regulatory: a proposed FTC order in 2024 requiring an information security programme, alongside a $2.95 million CAN-SPAM penalty that Verkada accepted without agreeing with the allegations.
- Wider: sensitive footage from hospitals, clinics and jails was viewed, a reminder that camera vendors' support tools can see what customers see.
What this means for NHI governance
The credential that opened Verkada's customers was not a person's login. It was a set of administrator credentials stored on a server so that support scripts could run, a classic non-human identity with broad standing privilege. It sat on a machine that was reachable from the internet, and it reached every customer the support team could reach. Verkada's own report and the hackers' account agree on that core: exposed admin credentials led straight into customer systems.
Support and automation credentials are often the most powerful in a SaaS platform because they are built to act on behalf of any customer. They need the strongest controls: vaulted storage instead of files on a server, just-in-time issuance per support case, scoping to the customer being helped, and logging that the customer can see. Cloud-managed devices add a further dimension, because the same credential can control physical cameras and door systems. Our Device and IoT Identity Guide and JIT Access Guide cover these controls.
Recommendations
- Revoke and rotate support credentials immediately after exposure. Assume any credential on a reachable server is compromised and replace it from a clean system. See the Leaked Credential Response Playbook.
- Never store admin credentials on automation servers. Inject them at runtime from a secrets manager with tight access policies. See our Secrets Management Guide.
- Replace standing support access with just-in-time access. Issue support privileges per case, scoped to one customer and expiring automatically. See our JIT Access Guide.
- Keep CI and support servers off the internet. Jenkins and similar tools should sit behind authenticated access proxies, with their exposure checked continuously. See our CI/CD Pipeline Identity Security Guide.
- Treat vendor support access as third-party access. Customers of cloud-managed devices should ask how vendor staff and tools reach their systems and whether they can approve or see that access. See our Third-Party Access Guide.
- Monitor privileged support sessions. Alert on support logins that touch many customer accounts in a short time.
Frequently asked questions
How did hackers get into Verkada's cameras?
Verkada says the attackers entered through a misconfigured Jenkins server used by its customer support team that was exposed to the internet. The server held admin-level credentials for running support scripts, and the attackers used them to log into a support interface with access to customer accounts and cameras.
How many Verkada cameras were hacked?
The hackers claimed access to 150,000 cameras. Verkada's investigation found that 97 customers had cameras accessed and video or images viewed, and that up to 4,530 cameras across 68 organisations may have been accessed through its Command interface, less than two percent of its roughly 6,000 customers.
What happened to Verkada after the breach?
Verkada disabled internal administrator accounts, published an incident report in April 2021 and worked with Mandiant on the investigation. In 2024 it accepted a proposed FTC order requiring an information security programme and a $2.95 million penalty for CAN-SPAM violations, while saying it did not agree with the allegations.
Related NHI Mgmt Group resources
Nissan Source Code Leak 2021 · Okta Support System Breach 2023 · Device and IoT Identity Guide · JIT Access Guide · Secrets Management Guide
How NHI Mgmt Group can help
Support tools and automation servers often hold the most privileged credentials in a SaaS business. We help teams find those credentials, move them into vaults, replace standing access with just-in-time access and give customers visibility of vendor support activity. See our NHI and AI agent security training.
References
- Security Sales & Integration: Verkada Breach by Hacker Group Exposes 150,000 Security Cameras (9 March 2021)
- Al Jazeera (Bloomberg): Surveillance cameras at Tesla, many others breached: Report (10 March 2021)
- US Department of Justice: Swiss Hacker indicted for conspiracy, wire fraud, and aggravated identity theft (18 March 2021)
- Verkada: Summary: March 9, 2021 Security Incident Report (7 April 2021)
- Infosecurity Magazine: Verkada Facing Penalty After Hackers Viewed Sensitive Video Footage (2 September 2024)