Can CCTV be hacked and how do you secure it?

Stories of hacked cameras are unsettling, but most incidents trace back to a handful of avoidable weaknesses. Understanding them makes securing your system straightforward.

How CCTV actually gets compromised

When home cameras are compromised, it is rarely through clever, targeted hacking. The far more common causes are mundane: default or weak passwords that were never changed, old firmware with known vulnerabilities, reused credentials exposed in a data breach elsewhere, or an insecure home network. Automated tools scan the internet for connected cameras using factory-default logins, which is why a camera left on its out-of-the-box password is the most exposed of all.

Cloud accounts add another route. If the account that controls your cameras shares a password with other services and that password leaks, an attacker may reach your cameras without touching the device itself. None of this means connected cameras are inherently unsafe — it means the security depends heavily on a few good habits. Treating a camera like any other internet-connected account, with a strong unique password and updates, removes most of the realistic risk.

The essential steps to secure CCTV

A short checklist covers most of the danger. First, change the default password immediately to a strong, unique one, and never reuse a password from another account. Second, enable two-factor authentication (2FA) on the camera's app or account if it is offered, so a stolen password alone is not enough to get in. Third, keep the firmware and app updated, since updates frequently patch security flaws — turn on automatic updates where available.

Fourth, secure the foundation: your home wifi router. Change its default admin password, use strong WPA2 or WPA3 encryption, and keep its firmware current, because a compromised router exposes everything on the network. Fifth, choose reputable equipment from manufacturers that issue regular security updates, and be cautious of very cheap, unbranded cameras that may never be patched. These steps are simple, free or low-cost, and between them they close the doors that opportunist attackers rely on.

Reducing exposure further

Beyond the essentials, you can reduce the attack surface. Disabling features you do not use — such as remote access or older insecure protocols some cameras ship with — limits the ways in. Some households put cameras on a separate guest network so that, even if a camera were compromised, it could not easily reach computers and phones on the main network. Reviewing which apps and people have access to your camera account periodically, and removing any you no longer need, is also worthwhile.

The most thorough way to cut remote risk is to avoid the internet for the cameras entirely. A local-only, wired system recording to an on-site DVR or NVR has no cloud account to breach and no remote login to attack, so the main hacking routes simply do not apply. The trade-off is losing remote viewing and alerts. Many people accept a middle path — connected for convenience but properly secured — while those most concerned about privacy choose offline recording for the strongest protection.

Indicative steps to secure home CCTV, from quick wins to stronger measures.

Why securing CCTV also protects others

Securing your cameras is not only about your own privacy. A compromised camera can expose footage of your household and anyone your cameras capture, and where your system is covered by UK GDPR because it films beyond your boundary, keeping footage secure is one of your duties under data protection law. A poorly-secured camera that leaks images of neighbours or passers-by is both a privacy failure and a potential breach of those responsibilities.

So the same good practices serve two ends at once: they keep intruders out of your system, and they help you meet the expectation to store footage securely. Get Safe Online and the National Cyber Security Centre (NCSC) both publish accessible, up-to-date guidance on securing smart devices and cameras, and they are good references to check periodically as advice evolves. The bottom line is that home CCTV can be hacked, but with strong passwords, 2FA, updates and a secured network, the realistic risk for a careful user is low.

It also helps to think about who has access over time. Camera accounts are often shared with family members or, during setup, with an installer, and those permissions can linger long after they are needed. Reviewing the list of people and devices that can reach your cameras, and removing any that no longer belong, closes a route that is easy to forget. The same applies if you replace a router or change broadband provider: make sure the old equipment is wiped or returned, and that any cameras are reconnected to a properly secured new network rather than left on default settings.

If you ever sell, return or dispose of a camera, treat it like any device that has held personal data. Perform a factory reset to remove your account details and any stored footage, and unlink it from your app, so that the next owner cannot access your information and you are not left with an orphaned device still tied to your account. These are small, occasional tasks, but together with strong passwords, two-factor authentication and regular updates they form a complete, low-effort routine that keeps a home CCTV system both secure against hacking and compliant with your duty to protect the footage it captures.

Frequently asked questions

Sources & further reading

• Get Safe Online — Smart devices and home cameras
• NCSC — Smart devices security guidance

Figures on this page are typical UK ranges drawn from published sources and depend on your specific property and system. They are guidance, not a quotation.