The Information · Google · AI Safety · Tom's Hardware
Flock seeks to have security researchers' map of Flock cameras taken down
Compiled by KHAO Editorial — aggregated from 1 source. See llms.txt for citation guidance.
◌ Single Source
A security researcher discovered a vulnerability in Flock’s website that gave him an access token without needing login credentials.
Key facts
- Hackers have recently discovered that the Flock cameras stored encryption keys directly on the device, which allowed them to extract more than 27,000 clips stored and find that it has taken more
- According to The Intercept, Joshua Michael used this to query ArcGIS, a third-party mapping and geospatial layer that Flock uses, to retrieve a database of Flock devices in November 2025
- The researcher used the information gleaned to build a map of Flock cameras and share it on a website he named the Flock Surveillance Map, which now lists the location of 335,701 cameras
- While Flock did not comment on The Intercept’s reporting before publication, Michael noted that he received a trademark infringement complaint on his site
Summary
According to The Intercept, Joshua Michael used this to query ArcGIS, a third-party mapping and geospatial layer that Flock uses, to retrieve a database of Flock devices in November 2025. Michael said that he immediately informed the company about the security flaw. Flock apparently fixed the vulnerability in January of this year after Michael published his findings, but the researcher could exfiltrate a Flock device location database before that. The surveillance company said that it has never been hacked, that Flock information has never been leaked, and that the Flock Safety cloud platform “has never experienced a data breach,” but Michael says that this does not reflect reality. He told The Intercept that it made this announcement “after I pulled their database of devices.” “That leaves two possibilities,” said the researcher.