One Admin Credential, Thousands of Camera Feeds: What Verkada Got Wrong About Least Privilege

In March 2021, an attacker got into the customer support systems of Verkada, a company that supplies and manages internet-connected security cameras for hospitals, schools, jails, and large businesses. The way in wasn't exotic: credentials for a "Super Admin" account were sitting exposed on a misconfigured customer support server, and once an attacker had them, they could use that single account to emulate other user sessions and reach customer devices directly.

The access that one credential unlocked was enormous. Reports after the breach put the number at around 150,000 cameras across more than 100 organizations, including live video and audio feeds, archived footage, and customer data like names, emails, and WiFi credentials. Some of the exposed feeds were inside psychiatric hospitals and women's health clinics — about as sensitive as camera footage gets. Verkada says it shut the access down within days of discovering it, which limited the damage, but by then the access itself had already happened.

In 2024, the FTC settled with Verkada for $2.95 million. It's worth being precise about what that fine was actually for, because it's not quite what you'd expect: it wasn't a HIPAA violation. The settlement covered a mix of things — failing to implement reasonable security practices (weak passwords, inadequate encryption, insufficient network controls), sending more than 30 million unsolicited marketing emails in violation of the CAN-SPAM Act (the largest CAN-SPAM penalty the FTC has ever issued), and making misleading claims about HIPAA and Privacy Shield compliance that weren't accurate. The breach is what got everyone's attention; the fine mostly wasn't about the breach itself.

Where least privilege actually broke down

Strip away the headline numbers and this is a textbook least-privilege failure, just at an unusually large scale. A single administrative credential sitting on a public-facing support server is already a mistake — it's an open invitation for anyone who finds it to grant themselves access they were never supposed to have. But the real failure is architectural: that one credential could reach every customer's camera feeds and data, not just the specific account it was meant to support.

That's the part that should have been designed out from the start. Support staff troubleshooting one customer's account shouldn't be one stolen credential away from every customer's account. A few things would have actually limited the blast radius here: MFA or a one-time-password requirement on the support portal itself, so a stolen credential alone isn't enough; and per-customer access secrets or tokens, so reaching one customer's feed doesn't automatically mean reaching everyone else's. Either one of those would have turned "one leaked credential" into "one compromised customer" instead of "every customer Verkada has."

Takeaway

The uncomfortable part of this story isn't that a credential got exposed — that happens. It's that the system was built so that exposing one credential meant compromising all of it. Least privilege isn't really about trusting your admins less; it's about designing things so that no single mistake, credential, or compromised account can reach more than it has to. Verkada's support team needed enough access to do their jobs. They didn't need the keys to every camera the company had ever sold.