FTC’s Verkada case: what camera buyers should ask vendors about passwords, encryption and network controls

In a case brought on the FTC’s referral, Verkada was required to run a comprehensive information security program with third-party audits and pay a $2.95 million CAN-SPAM penalty under an order entered September 4, 2024. The complaint alleged weak password, encryption and network controls let a hacker reach over 150,000 live customer cameras in March 2021.

Source facts

According to the FTC’s announcement, a complaint filed by the Department of Justice on referral from the FTC alleged that security camera firm Verkada failed to use appropriate information security practices, which allowed a hacker to access internet-connected cameras and view patients in psychiatric hospitals and women’s health clinics. It alleged that Verkada failed to require unique and complex passwords, adequately encrypt customer data and implement secure network controls, and that in a March 2021 breach the hacker had access to over 150,000 live customer cameras and to information such as physical addresses, audio recordings and customer WiFi credentials.

The FTC’s case page lists the complaint on August 30, 2024 and the stipulated order as entered by the court on September 4, 2024. The order requires a comprehensive information security program with third-party audits, prohibits misrepresentations about Verkada’s privacy and data security practices, and includes a $2.95 million penalty for CAN-SPAM violations, which the FTC called the largest it has obtained under that law.

The complaint also alleged misleading claims about compliance with HIPAA and the Privacy Shield frameworks, and undisclosed reviews written by employees and a venture capital investor. A Justice Department official said the settlement underscores the importance of robust data security, especially for companies in the security industry.

Applicability

Use this when choosing or reviewing cloud-connected camera and physical security vendors. The case concerns one company’s alleged practices, so treat it as a guide to what to ask vendors rather than a finding about other products.

DSE recommendation

DSE recommends asking every cloud camera or access control vendor for evidence of its security program, including independent audits, before purchase and at renewal. Require unique strong passwords and MFA for every account, review when vendor staff can reach your video, ask how stored data is encrypted, and avoid storing Wi-Fi credentials or floor plans in vendor portals unless needed.

Verification

Keep each vendor’s latest audit report or security attestation on file, review vendor support access settings quarterly, and confirm MFA is enforced for every user.

Official references

Federal Trade Commission — FTC Takes Action Against Security Camera Firm Verkada over Charges it Failed to Secure Videos, Other Personal Data and Violated CAN-SPAM Act. Federal Trade Commission — Verkada Inc., U.S. v. (case timeline). Reviewed October 19, 2026.