Verkada Camera Breach and Super Admin Credential Exposure

Verkada sold cloud-managed security cameras, and the pitch was simple: log into one dashboard and watch any camera, at any site, from anywhere. That convenience wasn't a side effect of the product. It was the product. Features like "People Analytics," which tracked faces, clothing, accessories, and gender across every connected feed, only worked if every camera fed the same centralized system. A camera that stored its own footage locally and answered only to its own building couldn't support cross-site face tracking, so the architecture had to pool everything into one place to deliver the feature customers were buying.

That pooling required constant connectivity. Verkada's cameras needed a persistent internet connection to reach the company's cloud service, which meant the cloud, not the camera, was always in charge. A hardware failure at the device level was recoverable. A failure at the cloud layer was unrecoverable company-wide, because every device's behavior, footage, and configuration routed through that one authoritative control plane, making it the precondition for a company-wide breach.

One login, total control over every customer

Centralized control requires someone to hold the keys, and Verkada built a single tier of super admin credentials that could do that job. Once authenticated, a super admin account could switch into any customer's environment and pull up any camera feed across Verkada's entire customer base, no matter which company owned the account or what contract that company had signed. This wasn't a loophole discovered after the fact. It was the designed function of the credential.

Verkada's own incident report described how attackers reached a Jenkins server "used by our support team to perform bulk maintenance operations on customer cameras," and that access alone handed them "video and image data from a limited number of cameras from a subset of client organizations." The support tooling itself carried cross-customer scope as a baseline feature, not an edge case. There was no intermediate rung on the ladder between a single customer's own admin panel and total visibility into every customer Verkada had ever signed. The system recognized two states: locked out, or god mode. Nothing in between existed to catch a compromised account before it reached everything.

Distributing that credential to dozens of internal users multiplied the attack surface

A credential with unlimited scope is a liability in direct proportion to how many hands hold it, and Verkada handed this one out widely enough that interns had it. A former senior-level employee told Bloomberg that interns at the company could view a vast number of camera feeds globally, with no apparent restriction tied to what their actual job required.

This isn't a story about reckless interns. Nobody asked to be handed root access to Sandy Hook Elementary's camera feed as a summer project; the architecture simply offered no narrower door to walk through. Every additional person holding the super admin credential was another login an attacker could target, another password that might end up reused somewhere, another laptop that might get phished. Access control works on a basic principle: give people what their role requires and nothing more. Verkada's system had no setting for "just enough," so when the company needed more hands on support tickets, it handed out full-scope keys because that was the only key that existed. The math here isn't complicated. Ten people with unlimited access is ten points of failure. Dozens of people with unlimited access, including interns rotating in and out on short tenures, is a target list that writes itself.

How the credential reached the internet

The final piece fell into place when one of those super admin credentials turned up somewhere it never should have been: an unencrypted subdomain meant for internal development use that had been left exposed to the open internet. The attackers didn't need to breach a firewall or write custom malware to find it. They needed a browser and some patience.

Verkada confirmed that the attackers obtained credentials that "allowed them to bypass our authorization system, including two-factor authentication." MFA protects a login screen, but it does nothing for a credential that's already sitting in the clear on an exposed server, because the attacker never has to face the login screen the normal way. The credential was hardcoded rather than rotated or vaulted, so once it leaked, it stayed valid indefinitely, with no expiration clock running down and no system flagging unusual use. There was no privileged access management layer at all: no vault, no rotation schedule, no audit trail that would have caught a login pattern that looked nothing like normal support activity. One of the attackers, Kottmann, put it directly: "This one was easy. We simply used their web app the way any user would, except we had the ability to switch to any user account we desired. We did not access any server. We simply logged into their web UI with a highly privileged user account." No zero-day. No exploit chain. A key left on the porch, under a mat with "SUPER ADMIN" stenciled on it.

What access at that privilege level enabled in practice

Super admin access wasn't a view-only pass. It included the ability to execute code on any camera in the system, treat compromised cameras as footholds into customers' internal networks, and pull the full client list. Verkada's own report confirms the attackers reached "lists of client account administrators and sales orders," well beyond video alone.

The footage pulled during the breach came from Tesla, Cloudflare, Equinox, and Nissan. It also came from a county jail, an elementary school, a regional hospital system, a medical center, and ICU departments in hospitals elsewhere. That range, corporate boardrooms to jail cells to intensive care units, says something about how broadly these systems had been deployed and how little the deployment context mattered once the credential was compromised. A single login reached all of it, in one session, because the architecture never distinguished between a Tesla factory floor and a hospital ICU. To the super admin tier, a camera was a camera.

The "just fix the password" framing misdiagnoses the failure

The easy read on this breach treats it as a hygiene failure: a credential leaked, MFA didn't catch it, rotate your secrets and move on. That framing isn't wrong so much as incomplete, and it stops exactly where the real problem starts.

Jeff Costlow, former Deputy CISO at ExtraHop, named the actual anti-pattern: "It is considered brittle security when you have one control protecting everything, and that is what appears to be the case here. Once you have access to one credential, you've got access to everything, that is an anti-pattern. That is not the way that it should be designed." Ray Canzanese, Director of Netskope Threat Labs at Netskope, made the same point from a different angle: "Backdoors built by default into a product with a standard reused secret is a dangerous thing. A leak of that secret means that anybody can now access any of those devices. And we, the industry, concluded long ago that is not a good approach to security."

Rotate the password, enforce MFA everywhere it belongs, and the cost of stealing a credential goes up. None of that changes the fact that one credential tier still held unlimited cross-customer control, still got handed to dozens of people including interns, and still ran with no monitoring on what a super admin session actually did once logged in. Fix the lock on the door and the house still has one key that opens every room in every house on the street. Credential hygiene patches the entry point. It leaves the blast radius exactly where it was.

The cloud aggregation model as a structural multiplier specific to vendor-managed IoT

Verkada's situation reflects a structural pattern that applies to cloud-managed IoT generally, not a one-off mistake unique to one company. A traditional on-premises camera system fails locally: breach one building's local recording device and the damage stops at that building. A cloud-managed system aggregates control, so breaching the vendor's management plane breaches every customer simultaneously, in a single event, regardless of how many separate buildings or companies those customers represent.

That's the trade built into managed security-as-a-service. The feature that makes the product convenient, logging in from anywhere to see everything, is structurally identical to the feature that made the Verkada breach total. Most businesses that bought these cameras had no way to know, and no contractual mechanism to verify, that Verkada employees, interns included, held root-level access to their footage. Eva Galperin of the Electronic Frontier Foundation observed that companies deploying these systems likely never expected anyone beyond their own security team to be watching. That's the quiet cost of outsourcing device management: a customer inherits whatever access model the vendor runs internally, sight unseen, and almost nobody audits it before signing the contract.

The FTC's enforcement action translated the architectural failure into regulatory liability

The breach happened in 2021. The FTC's enforcement action against Verkada came years later, over charges that the company failed to secure videos and other personal data and separately violated the CAN-SPAM Act. That gap between the architectural decisions and the legal consequence is itself instructive: regulators don't move at breach speed, but when they move, the liability doesn't evaporate just because the incident is old news.

The action puts IoT vendors on notice that security claims carry legal weight, not just marketing value. A company that advertises its product as secure while running an architecture that enables mass cross-customer exposure now faces enforcement risk on top of the reputational damage. The Verkada case stands as precedent for how the FTC treats vendors making unsubstantiated security claims, and that precedent extends to any cloud-managed device vendor running a similar design, whether or not that vendor has had its own breach yet.

The criminal side moved in parallel. Kottmann was indicted on March 18, 2021 by a grand jury in the Western District of Washington, facing charges including conspiracy to commit computer fraud and abuse, wire fraud, conspiracy to commit wire fraud, and aggravated identity theft, tied to intrusion activity from 2019 onward. The key charges alone carried exposure up to 27 years: 5 years for computer fraud conspiracy, 20 for wire fraud, plus a mandatory consecutive 2 years for aggravated identity theft, with the full indictment's additional counts potentially adding more. Extradition to face trial remained unresolved. Architecture gets fixed on an engineering timeline. Liability for failing to fix it runs on a different clock entirely, and that clock keeps running long after the headlines fade.

Controls that would have broken the chain at each compounding failure point

Three design choices built this breach, and each one had an available fix that Verkada didn't apply. The super admin tier had no scope limits, a problem solved by least-privilege segmentation at the vendor level: bulk maintenance operations don't require cross-customer camera viewing, so that capability should run on its own narrower credential with its own audit trail, separate from anything with global reach.

The credential was distributed too broadly, a problem solved by role-based access tied to documented justification for every person who holds it. If a role doesn't require global camera access to do its job, that role doesn't get the super admin credential, full stop on the justification required before anyone, intern or otherwise, gets handed the keys to every customer's footage.

The credential was also stored without protection, a problem solved by credential vaulting, rotation, and a real privileged access management layer. Vaulting wouldn't have stopped the development server from being exposed to the internet in the first place, but it would have meant the leaked credential had a short shelf life and left a record of its use, keeping it from sitting valid and invisible indefinitely. A credential that expires in hours is a different kind of risk than one that works forever once it's out.

The same logic extends past cameras. AI agents and automated systems now operate at machine speed while often inheriting human-scale access rights built for a person clicking through a dashboard, not a script running thousands of actions a minute. Without real-time behavioral monitoring and policy controls that actually enforce limits rather than just logging them, a compromised agent credential creates the same blast radius problem Verkada had, just faster, because by the time a human notices the anomaly, the damage is already done. Any organization evaluating a vendor that holds super admin or backdoor-level access to its devices should treat that vendor as a serious point of failure, and ask for evidence of credential vaulting, rotation, and audit logging before signing anything. Verkada's cameras were watching everyone. Almost nobody was watching Verkada.