Hackers Unlock Flock Camera Data After Removing Device

Hackers calling themselves stegan0gram removed a Flock Safety automatic number plate recognition camera and made a near-complete copy of its stored data and software. They recovered an encryption key from an unencrypted partition, allowing them to unlock videos and still images of thousands of vehicle detections. The material was shared with 404 Media, WIRED and Distributed Denial of Secrets, whose joint analysis found that the camera’s software explicitly detects people, vehicles, number plates and bicycles.

Flock said removing or tampering with its cameras is illegal, and that it had received no vulnerability report from the hackers.

The camera runs about 20 Flock-built Android applications. When movement is detected, it takes rapid bursts of images—typically about 28 per vehicle, although some generated more than 100—before sending selected material over cellular networks to Flock’s servers, where number plates and vehicle characteristics appear to be identified. Recovered logs covering about 21 days recorded roughly 50,200 vehicles and 1.6 million images.

Tests of extracted detection models found people in 11 of 27,321 short video clips, all involving motorcyclists, and showed the plate detector sometimes mistook bumper stickers, dealership frames and other graphics for plates. The researchers found no evidence that Flock’s face-recognition capability was enabled.

The disclosure follows security researcher Jon “GainSec” Gaines’ 2025 documentation of flaws capable of providing root-level access, which Flock said required physical access and would not expose footage. The recovered logs also contained more than 27,000 “no space left on device” errors, alongside crashes and reboots. Flock directed researchers to its Vulnerability Disclosure Policy and said it lacked enough information to assess the claims.