Can My Baby Monitor Be Hacked?

Wi-Fi baby monitors can be reached through weak passwords, leaked accounts and software flaws. Here is how intrusions happen, how to spot one and what to change.

A Wi-Fi baby monitor is a camera and microphone in your child’s room, and like any connected camera it can be reached by someone who should not be there. The Federal Trade Commission treats baby monitors as connected cameras and has taken companies to court over monitor feeds that ended up online. Most intrusions, though, trace back to a short list of fixable problems: reused passwords, missed updates and a home network where every gadget sits side by side.

How does someone actually get into a baby monitor?

Almost always through an account or a weak network, not by cracking your router from the street. Real cases fall into three groups. The first is account takeover: someone logs in to the monitor’s cloud account with a password leaked in a breach of some other website, which works from anywhere. The second is a weak home network, the kind with a default router password, a Wi-Fi password half the neighborhood knows and every device on one flat network. The third is a flaw in the monitor itself.

The TRENDnet case shows what a software flaw looks like. The FTC said the company’s cameras, sold for home security and as baby monitors, had faulty software that left feeds open to online viewing, and sometimes listening, by anyone who had the camera’s internet address. The complaint also said the company sent login credentials over the internet in plain, readable text.

Has this actually happened to real families?

Yes, repeatedly. In 2013, the FTC settled its first case against a maker of an everyday connected product after hackers posted links to the feeds of nearly 700 TRENDnet cameras, some showing babies asleep in cribs. Researchers kept finding problems after that: a 2015 Rapid7 study tested nine internet-connected baby monitors and gave eight of them a failing grade, citing hidden passwords and unencrypted video, and a 2020 Bitdefender study found flaws in one Wi-Fi monitor model that could expose stored video.

The Ring case is the largest example. The FTC said Ring’s weak privacy practices and security failures allowed its own employees to watch customers through their cameras, and left customer videos, including videos of kids, open to online attackers, who harassed, insulted and propositioned children through the cameras. Ring agreed to pay $5.8 million to affected customers in the settlement. There are individual incidents too, like a Houston family whose two-year-old’s monitor was hijacked through its two-way audio, with a stranger shouting obscenities at the child.

Are non-Wi-Fi radio monitors safer?

For remote attacks, yes, by a wide margin. A monitor that talks only to its own parent unit over a local radio link has no cloud account to steal and no internet address to probe, so someone across the country has no way in. The tradeoffs are practical: you give up checking the feed from your phone when you are out, and the range is limited to your house. Note that New York’s new law, covered below, does not cover radio-only models, since they do not transmit over the internet.

What are the signs someone is watching or listening?

The clearest ones are voices coming from the monitor that nobody in your house made, or the camera moving and pointing on its own. Beyond those, check the camera’s access logs if the app shows them. The FTC advises reviewing those logs for IP addresses you do not recognize and for access times that do not fit your normal patterns.

Other warning signs are worth acting on even if they seem small: a password reset email you did not request, an unfamiliar device or viewer listed in the companion app, or footage in your account’s history that you never recorded. Any one of these is a reason to change the password the same day.

Which monitor settings lower the risk?

Start with the account, since that is where most intrusions begin. Then work through the device:

• Set a unique password. Never use the default username and password, and never reuse one from another account. Defaults and reused passwords are easy for hackers to find online.
• Turn on encryption. Check what kind the camera has and how to enable it; encryption scrambles your account information, livestreams and archived video.
• Use two-factor authentication if the app offers it, such as a code sent to your phone along with the password.
• Sign up for automatic updates from the manufacturer so security bugs get fixed without you remembering to check.
• Disable what you do not use, such as remote viewing or remote management, and any microphone, camera, Bluetooth or location features that are not integral to the device.
• Check the sharing settings so you know exactly who the app says can view the feed.

What should you change on your router?

The FTC calls the router the key to privacy for connected devices, so the nursery monitor is only as protected as the network it rides on:

• Change the defaults. Replace the router’s default administrative username, password and network name, and avoid login details built from your name, your address or the router brand.
• Enable encryption in the router’s wireless security settings. Our guide to router and Wi-Fi terms explains the vocabulary if the menus feel unfamiliar.
• Separate the monitor. Put cameras and other smart gadgets on a guest network or their own network, away from laptops and phones, so a compromised device does not sit next to the ones holding your personal information.
• Know what is connected. The router’s web interface lists connected devices, sometimes called wireless or DHCP clients; look for anything you cannot identify.
• Disconnect old devices you no longer use, since their security may be out of date and can create a weak point.

What should you do if your monitor was accessed?

Change the password first, then check the access logs and install any pending firmware update. If you cannot confirm what was changed, unplug the monitor, factory reset it and set it up again from scratch, and delete any stored footage you did not create. Remove the device from your account and re-add it, and tell the manufacturer, since a hijacked camera is the kind of problem they need to hear about. If a company marketed security it did not deliver, you can file a complaint with the FTC, and in some states you can ask a company to erase the personal data it holds about you; rules vary, so check with your state agency. The wipe-and-reconfigure steps also matter if you ever sell or hand down a monitor; see getting rid of a smart device? wipe your data first.

Are there any laws about baby monitor security?

New York has gone furthest. On October 28, 2026, the state’s governor signed a law barring retailers from selling new baby monitors that connect to the internet unless the devices have built-in protections that stop outsiders from viewing or listening to the child’s room, plus a plainly worded label disclosing that the monitor connects to the internet. It takes effect 90 days after signing, around January 26, 2027, and covers only monitors sold new in New York, not ones families already own. At the federal level, the FTC has enforced against companies over insecure camera software, and California requires connected devices sold there to have reasonable security features. What counts as reasonable, and what other states require, varies, so confirm details with your state agency.

Do audio-only connected monitors and voice assistants add risk?

An audio-only monitor that connects to the internet carries the same account and network risks as a video one. The picture is missing, but the login, the cloud service and the companion app are not, so the same password, update and sharing checks apply. Smart speakers and assistants add always-on microphones to the room; New York’s smart home guidance suggests disabling microphone, camera, Bluetooth and location features that are not integral to how you use a device, and denying access when prompted. Federal children’s privacy law, COPPA, gives parents certain rights over personal information collected online from their kids.

For a wider look at what connected cameras collect and how to set one up carefully, see home security cameras without the privacy problems. And if the nursery also holds a speaker, plug or thermostat, our smart home privacy checkup walks through the settings worth reviewing on each one.

Reader questions

Can someone hack my baby monitor from outside my house?

Yes, if the monitor connects to the internet. Most real cases involved someone logging in to the camera’s cloud account with a reused or leaked password, which works from anywhere. Monitors that only talk to their own parent unit are much harder to reach remotely.

How do I know if my baby monitor has been accessed?

Watch for voices nobody in your house made, the camera moving on its own, IP addresses you do not recognize in the access logs, or access times that do not fit your patterns. Any of these is a reason to change the password immediately.

Are audio-only connected monitors safer than video ones?

No. An audio-only monitor that connects to the internet still has a login, a cloud service and an app, so the same password and update habits apply.

Should my baby monitor be on its own Wi-Fi network?

The FTC suggests putting cameras on a separate network from computers and phones, so a compromised gadget does not sit side by side with your personal devices. Most routers can set up a guest network for this.

We describe how services generally work; features, settings and terms change often, and they differ between companies. This is general information, not legal advice. Check the provider’s current policies and official sources such as FTC.gov.