Hacker Group Breaches Street Surveillance Cameras to Expose Widespread Vehicle Tracking Data

2026-09-17 companies

Atlanta, Wednesday, 16 September 2026.
Reverse-engineered surveillance camera logs revealed a single device captured 1.6 million images of 50,000 unique vehicles in 21 days, highlighting growing cybersecurity and privacy risks for public infrastructure.

Surveillance Data Exposed by Hacker Collective

On Wednesday, 16 September 2026, a hacker collective identifying as “stegan0gram” publicly released data extracted from a physical Flock Safety automated license plate reader camera [1][7]. The breach involved the physical removal of a device from a roadway, followed by reverse-engineering that bypassed on-device encryption protections [1][8]. Analysis of the recovered dataset revealed that a single camera unit captured approximately 1.6 million images of 50,000 unique vehicles over a 21-day period [1][4]. This volume equates to an average data capture rate of 76190.476 images per day per device, highlighting the intensive surveillance capacity deployed in local communities [1][8]. The leaked files included thousands of video clips and logs confirming that the system tracks vehicles, license plates, bicycles, and occasionally people [1][4].

Technical Vulnerabilities and System Architecture

Technical examination of the compromised hardware indicated that Flock Safety cameras operate on an Android-based system running approximately 20 proprietary applications [1][8]. Hackers discovered an unencrypted “media” partition on the hard drive which contained the encryption key necessary to access stored video and image files [4][8]. While Flock Safety previously claimed devices were protected by on-device encryption, the breach demonstrated that physical access allowed attackers to recover stored keys and bypass these safeguards [1][4]. Despite extensive analysis of the software models, investigators found no evidence of active facial recognition capabilities beyond default Android operating system features [1][4]. However, the system did log specific locations of individuals within frames and assigned confidence scores to detections [8].

Municipal Contract Terminations and Data Governance

Prior to this breach, the City of Boston announced on Monday, 14 September 2026, that it would terminate its use of Flock Safety technology following a separate data governance failure [6][7]. A 2025 pilot program revealed that a “nationwide lookup” feature had been enabled by the vendor without city approval, allowing law enforcement agencies outside Boston to access local data [2][6]. This vendor error violated the contractual agreement which stipulated that data access be restricted exclusively to trained Boston Police Department personnel [2]. Consequently, Boston joined at least 25 other municipalities nationwide that have recently moved to cancel or pause contracts with Flock Safety due to privacy and oversight concerns [6][7]. Incidents of data misuse have been reported, including cases where police officers used the system to track former partners [6][7].

Market Impact and Future Surveillance Risks

Flock Safety, which holds a valuation of approximately $8.4 billion, operates a network of over 120,000 AI-enabled cameras across 49 states [6][7]. The company’s infrastructure allows data sharing among various agencies, with records in some jurisdictions accessible to over 2,000 organizations including police, colleges, and federal agencies [1][7]. Security researchers note that the combination of mass data collection and physical vulnerabilities presents significant risks for civil liberties and community trust [4][8]. As municipalities reassess their surveillance contracts, the incident underscores the operational risks associated with third-party vendors managing sensitive public data infrastructure [1][6]. Flock Safety stated that unauthorized tampering is illegal and that they maintain a vulnerability disclosure policy, though no report was received regarding this specific breach [1][8].

Sources

Cybersecurity Surveillance Tech