By Paresh Dave and Jeffrey Dastin
(Reuters) – A small group of hackers viewed surveillance footage from hundreds of businesses including Tesla Inc by gaining administrative access to camera maker Verkada over the last two days, one of the people involved in the breach told Reuters.
Swiss software developer Tillie Kottmann, who has gained attention previously for finding security flaws in mobile apps and other systems, shared screenshots from inside a Tesla factory on Twitter and an Alabama jail in messages to Reuters. Kottmann declined to identify other members of the hacking group.
Kottmann said they sought to draw attention to the pervasive monitoring of people after having found login information for Verkada’s administrative tools publicly online this week.
Verkada acknowledged an intrusion, saying it had disabled all internal administrator accounts to prevent unauthorized access.
“Our internal security team and external security firm are investigating the scale and scope of this issue, and we have notified law enforcement,” the company said.
Kottmann said Verkada cut off the hackers’ access hours before Bloomberg first reported the breach on Tuesday.
Verkada on its website says it has over 5,200 customers, including cities, colleges and hotels. The startup’s cameras have proved popular because they pair with software to search for specific people or items. Users can access feeds remotely through the cloud.
A list of user accounts provided by the hacking group and seen by Reuters includes thousands of organizations, including gym chain Bay Club and transportation technology startup Virgin Hyperloop.
Reuters could not independently verify the authenticity of the list or screenshots distributed by Kottmann, but they included detailed data and match other materials from Verkada.
Tesla, Madison County Jail in Alabama, Bay Club and Virgin Hyperloop did not immediately respond to requests for comment.
Verkada has raised $139 million in venture capital, with the latest financing announced a year ago valuing the Silicon Valley startup at $1.6 billion.
Verkada drew scrutiny last year after Vice reported that some employees had used company cameras and its facial recognition technology to take and share photos of female colleagues. Chief Executive Filip Kaliszan later described the behavior as “egregious” and said three people had been fired over the incident.
(Reporting by Paresh Dave and Jeffrey Dastin, Editing by Rosalba O’Brien)
