Can a Wi-Fi Baby Monitor Be Hacked? What the Documented Cases Show

In November 2019, a family in Seattle heard a stranger's voice come through their nursery. Their Fredi-brand Wi-Fi camera had been accessed remotely, the lens had swiveled on its own, and the voice used their three-year-old's name before saying "I love you." The parents called the police, then the FBI, then unplugged the camera. Cases like it recur often enough that a device sold specifically as a baby monitor has already been the subject of a federal case.

That case is worth naming, because it settles the argument about whether this is hypothetical. In 2013 the Federal Trade Commission brought a complaint against TRENDnet, whose SecurView cameras were marketed, in the company's own words, "for purposes ranging from home security to baby monitoring." A defect in the camera's software let anyone with a camera's internet address view the live feed with no login at all, and in January 2012 a hacker found and published links to roughly 700 of them. Some of the feeds showed babies asleep in their cribs. The final order, approved in February 2014, put TRENDnet under twenty years of mandatory third-party security audits.

A Wi-Fi baby monitor is an internet-connected camera aimed at your child's crib, running software from a company you have probably never heard of, on a device most families set up once and never think about again. The question is not whether that category has ever failed. It has, repeatedly, with a name and a case number attached. The question is what specifically fails, and what closes the gap. It is a narrower question than whether monitors as a whole reduce risk to your baby, which our guide on breathing monitors and SIDS covers separately, since account security and physiological monitoring are two different claims that get marketed together and should not be evaluated together.

What the researchers actually found

TRENDnet is the case with the federal paper trail, and the instances that followed show a consistent pattern across brands rather than one company's isolated mistake.

In September 2015, Rapid7 researchers Mark Stanislav and Tod Beardsley published a study that tested video baby monitors from six different manufacturers and disclosed ten vulnerabilities across them: backdoor credentials, privilege escalation bugs, stored cross-site scripting, predictable information leaks, and authentication that could be bypassed outright. The common thread across those ten findings was not one clever exploit. It was password and session handling that a 2015 web application would have already been expected to get right.

In February 2018, the Austrian security firm SEC Consult disclosed six vulnerabilities in the Mi-Cam monitor sold by miSafes, after the manufacturer did not respond to a private disclosure attempt that had started two months earlier. The flaws included weak default credentials and broken session management, and SEC Consult demonstrated that modifying a single HTTP request was enough to pull up another family's live video feed and account details, no password guessing required.

None of this requires a sophisticated attacker. What connects TRENDnet, Rapid7's six brands, and Mi-Cam is the same short list of basic mistakes: a default password the buyer was never prompted to change, video that was not encrypted in transit, or a session token that the server did not actually check belonged to the account requesting it. That is also, not coincidentally, the exact list the FTC tells manufacturers to fix in its own IoT security guidance, "Careful Connections: Keeping the Internet of Things Secure." The agency's core recommendations are unglamorous on purpose: unique passwords instead of shared defaults, encryption for data in transit and at rest, and multifactor authentication where the product supports it.

Why DECT sidesteps the whole category of problem

A DECT monitor, the kind with a dedicated handheld screen instead of a phone app, has no cloud account, no internet-facing login, and nothing that leaves the house. There is no server to breach because there is no server. That is not a marketing claim, it is the mechanism, and it is the reason a family that has read this far and wants the risk gone rather than managed might reasonably decide the trade-off is worth the smaller screen and the shorter range. Our Wi-Fi versus DECT comparison works through the rest of that trade-off, including the connectivity side most families weigh first, and the DECT roundup has the current picks if that is where this lands you.

That is a real option among several reasonable ones. A Wi-Fi monitor gives you the room from a hotel Wi-Fi network on a trip, lets a grandparent check in from across the country, and generally does more than a handheld screen can. None of the documented incidents above mean a connected monitor is not worth owning. They mean it is worth buying and configuring like the internet-connected device it actually is.

What to check before you buy a connected monitor

The FTC's guidance and the pattern in the actual incidents point at the same short checklist, and every item on it is answerable from a product page or a five-minute account setup, not a technical audit. Run it against whatever is on your shortlist, including anything from our baby monitor roundup, before you buy.

Does it force a unique password at setup, or ship with a default? A camera that lets you skip past the password step, or that ships with something like "admin/admin," is the single most common root cause across every case above. If the setup flow does not require you to set a real password before the camera goes live, that is disqualifying.

Is video encrypted in transit and at rest? This is rarely on the spec sheet in plain language, but a brand's own security or privacy page will usually say so if it is true, because it is the kind of claim companies are eager to make when they can back it up. If the page is silent on encryption entirely, treat that silence as the answer.

Does the account support two-factor authentication? A password alone is one factor. A monitor account tied to an email address that anyone can attempt to log into is the same shape of risk as the account-takeover claims in the FTC's 2023 case against Ring, where the agency alleged the company's own access controls let unauthorized people reach customer camera feeds. Two-factor authentication is a free feature most established brands now offer, and turning it on removes most of the risk a leaked password creates.

Has the brand disclosed a past breach, and how did it respond? A company that has had an incident and published a clear account of it, a fix, and a timeline is not automatically the worse choice. A company you cannot find any security history on at all, usually a newer or smaller import brand, is the harder one to evaluate, and that is itself useful information.

If you already own one

Four changes take under ten minutes combined and close most of the gap between a monitor set up out of the box and one that has actually been secured.

Change the password from whatever it shipped with, even if the app never prompted you to. If dropped connections are the more pressing complaint in your house, our guide to monitor range in a house with thick walls is worth reading alongside this one, since the router changes that fix range often improve security too by moving the camera onto a segmented guest network. Use one you have not reused on another account, since a leaked password from an unrelated breach is one of the more common ways an account gets accessed. Turn on two-factor authentication if the app offers it, in the account settings rather than the camera settings. Check for a firmware update, since the fixes in cases like Mi-Cam's only reach a device that has actually installed them, and an unpatched camera from a brand that shipped a fix two years ago is functionally the same risk as one that was never fixed at all. And check what a canceled subscription actually turns off, because a camera that keeps streaming to an account you no longer actively manage is not a device you have secured, it is one you have stopped paying attention to.

Questions people actually ask

Is this a reason to avoid Wi-Fi baby monitors entirely?

The documented cases are real, but every one of them traces back to a specific, checkable failure: a default password, unencrypted video, or broken session handling. A monitor from a brand that gets those basics right is a different risk profile than the ones named above. A DECT monitor removes the category of risk entirely by having no internet connection at all, which is a legitimate reason to choose one, but it is a preference rather than the only safe answer.

Does a bigger, more established brand mean it is safer?

Not automatically, but it correlates. Ring and D-Link are large, established companies and both settled FTC cases over security lapses. What tends to differ by size is what happens after: a large brand more often has a documented incident response, a security page, and a patch history you can actually check. A brand with no findable security history is harder to evaluate, not necessarily worse.

What is the single most useful thing I can do right now?

Change the account password to one not used anywhere else, and turn on two-factor authentication if the app offers it. Those two changes address the failure mode behind nearly every documented case above, including TRENDnet, Mi-Cam, and the account-based incidents in the FTC's Ring case.

Do these vulnerabilities affect the vitals-tracking wearables too, like Owlet?

The incidents named here are specifically about video cameras and their account systems. A wearable sock or clip has a different attack surface, mostly the app and cloud account rather than a live video stream, and none of the cases above involve one. The account-security checklist, unique password and two-factor authentication, still applies to any connected device with a login.

How do I know if my specific monitor has had a disclosed vulnerability?

Search the brand and model name alongside terms like "vulnerability" or "CVE," and check whether the manufacturer has a security or trust page that lists past disclosures and fixes. A brand that publishes nothing on the subject has not necessarily had no incidents; it may simply not be the kind of company that discloses them, which is itself worth weighing.

Sources

• FTC, Marketer of Internet-Connected Home Security Video Cameras Settles FTC Charges It Failed to Protect Consumers' Privacy (2013)
• FTC, FTC Approves Final Order Settling Charges Against TRENDnet, Inc. (2014)
• FTC, FTC Says Ring Employees Illegally Surveilled Customers, Failed to Stop Hackers from Taking Control of Users' Cameras (2023)
• FTC, Careful Connections: Keeping the Internet of Things Secure
• Rapid7, Hacking IoT: A Case Study on Baby Monitor Exposures and Vulnerabilities, Mark Stanislav and Tod Beardsley (2015), information.rapid7.com
• SEC Consult / Bitdefender HOTforSecurity, disclosure of six Mi-Cam vulnerabilities (2018), bitdefender.com
• NBC News, Stranger hacks baby monitor, tells child "I love you" (2019)
• CPSC recall database