Insecam and public webcams: why private cameras end up online

In November 2014 a website called Insecam went online and showed, in a tidy grid, live pictures from tens of thousands of security cameras. Parking lots and shop counters, but also backyards, living rooms and children’s bedrooms. None of the owners had agreed to be on it. Their cameras still ran on the factory password. Anyone who knew the model could log in.

The site is still around. It sits right next to a far friendlier category: public webcams that people put online on purpose, pointed at beaches, ski slopes and bear-filled rivers. Both kinds of camera often use the same hardware. The difference lies in whether anyone meant for you to watch.

This piece is part of our OSINT series, which has also covered free satellite imagery and how to use it to check claims. Here we look at the useful side of public webcams, how private cameras end up in directories like Insecam and search engines like Shodan, and how to make sure your own doorbell, baby monitor or backyard camera is not among them.

Public webcams people want you to see

Towns bolt cameras to their water towers, ski resorts put them at the summit, and the National Park Service runs them from Yellowstone to the Everglades. The most famous set sits in Katmai National Park in Alaska. Eight cameras run by the nonprofit network Explore.org watch the brown bears at Brooks Falls as they snatch salmon out of the air. According to the Guardian, the Brooks Falls cam was viewed 7.3 million times between June 22 and August 4, 2026. Every fall viewers vote in Fat Bear Week on which bear has packed on the most weight for the winter. The cameras run on solar power and satellite internet, and before Fat Bear Week the field engineers travel out to the park to check every link.

For verification work these feeds are more than entertainment. When a video claims to show a certain city on a certain morning, an archived webcam can confirm or sink the claim. Was there snow on the ground? Was the square packed or empty? Do the shadows fit the hour? Combined with historical weather records and satellite passes, a few webcam frames can pin down what a place actually looked like.

How a home camera ends up on the open internet

A $30 security camera is a small computer with a lens. It runs an operating system and a little web server, and often a video service that hands out a live stream to anyone who asks. At home that is fine. The trouble starts when that little computer becomes reachable from the internet.

Usually the router does it. If you want to check the camera from work, you set up port forwarding, or the camera sets it up itself through UPnP. That router feature lets devices on your network open a door to the outside world without asking. It is convenient. That is also why so few people notice. From then on the camera answers requests from any computer on earth.

That alone would matter less with a proper password in front of it. Many older cameras, though, shipped with a factory login that was identical on every unit of a model and printed in the manual. Often it was some variation of admin. Leaving it unchanged is like locking your front door and taping the key to it, on a street the entire internet can walk down.

A third route runs through the manufacturer account. Most current consumer cameras no longer open ports at all and send their video through the company’s cloud instead. That is generally safer. It shifts the risk to your login, though. If that login shares a password with a shopping site that was breached years ago, strangers can walk right in.

What Insecam actually is

Insecam was launched by an anonymous programmer and hosted in Russia. At its peak in November 2014 it listed around 73,000 cameras in 152 countries, sortable by country, manufacturer and even scenery, each with coordinates and a map pin. CNET counted more than 11,000 of them in the United States alone. Most came from big brands such as Foscam and Panasonic, and nearly all still ran on default credentials.

The operator said he wanted to raise awareness. Most coverage was less charitable. Journalists found churches, bars and barbershops in the listings, along with bedrooms and nurseries. Britain’s data protection regulator, the ICO, urged owners to change their default passwords, and US officials voiced concern that the site could be used to stalk people. Many cameras vanished within days as owners learned from the news what they had been broadcasting.

The site went dark briefly, replaced by a note that a programmer was looking for a good remote job. On November 25 it came back, now promising that every camera was picked by hand so that it would not invade anybody’s private life. A 2018 study found that at least 560,293 different cameras had appeared on Insecam at some point. As of 2025, according to Wikipedia, only a little over 2,000 live feeds remained.

Shodan, the search engine behind the curtain

Insecam was a storefront. The machinery behind this kind of discovery is Shodan, a search engine that programmer John Matherly launched in 2009. It does not read web pages the way Google does. It keeps knocking on addresses across the internet and records which devices answer and what they say about themselves. Routers, printers, industrial controls, servers and cameras, including ones that serve video over the streaming protocol RTSP.

Security teams use Shodan to find their own weak spots before someone else does. The same index works as a catalog for people with worse intentions. You will not find search tips for other people’s cameras here. You do not need them. Checking your own camera works better another way.

When the flaw is at the manufacturer

Open ports and factory passwords explain one half of the story. The other half of the well-known cases has little to do with the owners.

In the fall of 2016 a piece of malware called Mirai took over huge numbers of IP cameras, video recorders and routers. According to the federal agency CISA, it tried a short list of 62 common default logins and enlisted every device where one worked into a botnet. Its author published the source code at the end of September. On October 21, 2016, attacks from Mirai-infected devices knocked the DNS provider Dyn offline in three waves, and major sites were unreachable for many users across the eastern United States and Europe. The cameras kept recording throughout.

In December 2019 a family in DeSoto County, Mississippi, heard a stranger’s voice come out of the Ring camera in their daughters’ bedroom. Ashley LeMay had bought it on Black Friday. Someone had logged into the account and was talking to her eight-year-old through the speaker, claiming to be Santa Claus. Ring said at the time that its systems had not been breached and that reused passwords were to blame. The FTC told a fuller story in 2023. According to its complaint, Ring suffered credential-stuffing attacks in 2017 and 2018 but did not roll out two-factor authentication until 2019, and attackers reached the accounts and videos of about 55,000 US customers. The complaint also said one employee had watched thousands of recordings from female customers’ bathrooms and bedrooms over several months. Ring agreed to pay $5.8 million, and the FTC sent refunds to customers in 2024.

A year later, in December 2020, the FBI warned about a new twist on swatting. Criminals used stolen email passwords to log into camera-equipped smart devices, called in a fake emergency at the victim’s address, and then watched and sometimes livestreamed the police response through the victim’s own camera.

In March 2021 a hacking group got into the systems of the business camera maker Verkada and could watch more than 150,000 live feeds. They included Tesla facilities, Cloudflare offices, jails, schools and psychiatric hospitals. One of the hackers said the point was to show how widespread and how easy to hijack this kind of surveillance had become. In 2024 the FTC and the Justice Department settled with Verkada, which agreed to build a real security program. It also paid a $2.95 million penalty, though that part was for spamming prospective customers.

The strangest case is the most recent. In February 2024 an outage at Amazon’s cloud took down the service of the camera maker Wyze. When cameras came back online all at once, a caching library mixed up devices and accounts. About 13,000 users saw thumbnails from strangers’ homes in their app, and 1,504 tapped one open. Nobody cracked a password. A bug was enough.

How to check if your own camera is exposed

The most honest test starts in your router. Open its admin page, usually at an address printed on the device, and look for the port forwarding list. An entry that points at your camera, video recorder or baby monitor means the device can be reached from outside. Most routers show the UPnP setting right next to it, often with a list of openings that devices created on their own. That list is often long.

Next, check the manufacturer account. Most apps show which phones and sessions are signed in, and some log who viewed the live feed and when. A phone you do not own settles the question. So does a login from another state.

A simple hands-on test works like this. Turn off Wi-Fi on your phone so you are on cellular data only. Then try to reach your camera’s web interface through your home connection’s public address, without the manufacturer app. If a login page appears, everyone else can see it too. Your router shows the public address.

Also pay attention to what the device itself tells you. A pan-and-tilt camera that swings around by itself, noises from the speaker, a status light that turns on for no reason: all of these are serious warning signs. For a broader look at telltale signs of someone else on your devices, see our guide on how to tell if your phone has been hacked.

How to lock it down

If you found a port forward for the camera, delete it. If you do not knowingly need UPnP for a specific device, turn it off. Then change the camera’s password, both for its local web interface and for the cloud account, and make each one long and used nowhere else. If the maker offers two-factor authentication, switch it on.

Firmware comes next. Many old holes were patched years ago. Not on devices that never got the update, of course. If the manufacturer has stopped shipping updates entirely, that is a good reason to retire the camera, at least from indoor use.

That leaves the choice between cloud and local. A camera that routes its video through the company’s servers opens no ports and stays invisible to scanners like Shodan. In exchange you trust the company, and Ring, Verkada and Wyze show that this trust is not always earned. A purely local camera without internet access is the safest option but cannot be checked from afar. If you want both, put remote access behind a VPN into your home network, if your router supports one. It takes an afternoon. Afterward no door is left open.

One question no setting can answer. Does the camera really need to be there? A camera over the driveway is one thing, one in the bedroom quite another. Many of the most disturbing cases of recent years started with a camera in a room where people expect to be unobserved.

Regulation is slowly catching up. Britain banned universal default passwords on new smart devices in April 2024, and since August 2025 new wireless devices sold in the EU must meet binding cybersecurity rules. In the US the FCC’s voluntary Cyber Trust Mark label is still getting started and picked a new lead administrator in April 2026. None of this reaches the camera that has hung over your garage for six years. What the router itself gives away about where you live, and what old factory settings leaked, is covered in our piece on the BSSID.

Webcam covers and the sextortion email

That leaves the camera closest to you, the one in your laptop. In 2016 a photo of Mark Zuckerberg made the rounds because the laptop behind him had tape over its camera. Two months earlier FBI Director James Comey had said he covered his, because he had seen somebody smarter than him do it. That is not paranoia. Researchers at Johns Hopkins showed in 2013 that on some older MacBooks the green indicator light could be switched off while the camera kept running. Whether something similar is possible on your own machine is hard to judge yourself. A cover does no harm, but it only blocks the picture and not the microphone.

Far more people meet this topic through their inbox. Someone claims to have taken over your computer and filmed you through the webcam at an intimate moment, and unless you pay in Bitcoin the video goes to your family and coworkers. Sometimes an old password of yours appears in the message as proof. The FTC has warned about these emails for years and puts it bluntly: the claims about your computer or webcam are all talk. The messages go out in bulk to enormous address lists, and the password comes from some earlier breach. Germany’s consumer protection centers, which have collected thousands of them, reach the same conclusion.

So do not pay. Do not reply either. Leave any attachments closed. If the quoted password is still in use somewhere, change it there. You can check whether your address appears in known breaches yourself.

The bottom line

Webcams live in two worlds. The hardware rarely tells you which one. The same lens can show a waterfall in Alaska or a kitchen in Ohio. What ends up online depends on a router setting, a password and, sometimes, a bug at the manufacturer.

For your own camera most of this can be settled in one evening, usually with a careful look at the router and a fresh password. After that you can go back to watching the bears with a clear conscience.

And if your worry runs the other way, a stranger’s camera in a holiday rental or hotel room: we cover how to find hidden cameras in a separate article.

Frequently asked questions

Is Insecam legal?

The site itself operates from Russia and has stayed online since 2014, so US law has little grip on it. Viewing a stream is a different matter from logging into one. Streams that are simply open to anyone sit in a legal gray zone, but using a default password to get into a camera that is not yours can count as unauthorized access to a computer under the Computer Fraud and Abuse Act and similar state laws. Watching strangers inside their homes also does real harm, whatever a court might say.

How do I know if my security camera has been hacked?

Start in the app or the account on the manufacturer site and look at the list of signed-in devices and sessions. Anything you do not recognize is a red flag. A pan-and-tilt camera that moves by itself, a status light that comes on when nobody is using it, or a voice through the speaker are clear signs. In your router, check the port forwarding list and whether UPnP is on. If in doubt, factory-reset the camera, install the latest firmware and set a new, unique password with two-factor authentication.

Can someone see me through my security camera?

Yes, if they have your account password or the camera is reachable from the internet with a default login. Most documented cases in the US came from reused passwords rather than broken encryption. The FTC found that attackers reached the accounts and videos of about 55,000 Ring customers this way. Unique passwords and two-factor authentication close the most common door.

Should I use a webcam cover on my laptop?

It costs next to nothing and cannot hurt. A slider reliably blocks the picture, though not the microphone. Normally an indicator light shows when the camera is on, but researchers at Johns Hopkins showed in 2013 that the light on some older MacBooks could be switched off while the camera ran. Mark Zuckerberg and the former FBI director James Comey both said they covered theirs.

I got an email saying my webcam recorded me. What should I do?

Do not pay and do not reply. These messages go out in bulk to huge address lists, and the senders almost never have any footage. If the email quotes a real password of yours, it came from an old data breach. Change that password everywhere you still use it, and report the email to the FTC at ReportFraud.ftc.gov.