Is a baby monitor app safe? Hacking, the cloud, and what "no account" really means

Have baby monitors and home cameras really been hacked?

Yes. What is striking is how ordinary the methods were: somebody logged in, or a company's own systems got it wrong. Incidents checked on September 29, 2026:

Each company fixed its problem; none of this means their current products are unsafe. The pattern is the point: the weak spot was almost always the account, the maker's servers, or a device open to the internet.

How does a baby monitor actually get hacked?

Six doors, roughly in order of how often they were used:

• Your cloud account. Someone tries your email with a password leaked from another site. Same password, no second factor: they are in.
• The maker's side. A bug on the vendor's servers shows your camera to somebody else (Wyze), or the vendor stores more than it said (Eufy, iBaby). You can't patch this; you can only choose how much reaches those servers.
• A camera exposed to the internet. Port forwarding or UPnP lets the camera's login page be reached from anywhere; add a factory password and you have Mirai.
• Weak Wi-Fi. A short Wi-Fi password or a router with its factory admin login lets a neighbor onto your network, where a local camera is just another device.
• The camera's own cloud. A Wi-Fi camera keeps talking to its maker even when you watch it in another app. TP-Link says Tapo cameras need the internet for first setup, remote viewing, sharing and clock sync, and work locally once set up. If you don't want that traffic, block the camera's internet access on your router.
• The phone itself. No screen lock on the parent phone, or a baby phone still signed in to your email, is the biggest exposure to anyone who actually gets near it.

What does "local only, no account" change, and what doesn't it?

A local-only app sends video from the camera to your phone over your own Wi-Fi and stops there. With no account, there is nothing to credential-stuff. With no servers holding your video, an outage can't show your nursery to a stranger and an employee can't browse it. That closes the first two doors, the ones behind the biggest cases.

The other doors are in your house: the router, the camera's firmware, the phone you watch on. "Local" puts them in your hands, which is the point.

How Mamoon handles it

There is no Mamoon account and no Mamoon cloud. Video goes from the baby phone or camera to the parent phone over your home Wi-Fi and works with the internet down. Cry detection runs on the phone itself, so no audio leaves it. There are no recordings or cloud clips to leak; the morning overview stays on your phone.

Away from home, Mamoon uses Tailscale, a free VPN built on WireGuard. Tailscale documents that traffic is end-to-end encrypted between your devices and that its relay servers only handle already-encrypted packets: the private keys never leave your phones, so a relay can't read the video. You install it on both phones, or on a home server for a Wi-Fi camera.

Mamoon is not the only app that works this way. Dormi (Android only) advertises encrypted streaming with no ads and no tracking. Cloud Baby Monitor uses only your home Wi-Fi by default and needs no internet unless you turn on its Unlimited Range. Baby Monitor 3G requires no account and encrypts the connection; it works over Wi-Fi or cellular. Bibino says plainly that communication goes through its servers and Premium recordings are kept there for 21 days, which is what gives it range with no setup. They draw the line in different places.

Is it safe to use an old phone as a baby monitor?

In one way an old phone is safer than a Wi-Fi camera: no port on your router, no maker cloud of its own. The risks are the phone's. One too old for security updates has known, published holes; one still signed in to your email and photos is a trove for whoever picks it up. Update it as far as it goes, remove accounts it doesn't need, set a screen lock. Setup is in the old phone guide.

The checklist

1. Lock down the router. Set Wi-Fi encryption to WPA2 or WPA3 and change both passwords: the Wi-Fi password and the router's admin login. The FTC's home Wi-Fi guide puts these first.
2. Update the camera's firmware. Turn on automatic updates if offered, as the UK's NCSC advises. Since April 2024, UK law requires makers to publish how long they will provide updates; read that number before you buy.
3. Change every default password. The camera's, the router's, and the Camera Account on a Tapo. Mirai's whole toolkit was a list of 62 factory logins.
4. Turn on two-factor authentication on any cloud account you keep: the camera maker's, your Apple or Google account, your email. Reused passwords opened 55,000 Ring accounts.
5. Turn off UPnP and port forwarding on the router unless you know exactly why you need them; CISA and the NCSC both say so. To reach a camera from outside, use a VPN such as Tailscale instead of an open port.
6. Think before using a guest network. A guest or "IoT" network keeps the camera away from your laptops, but many guest networks isolate devices from each other, so a local-only app on your phone may not see the camera. Put both on the same network, or turn client isolation off for that one.
7. Prepare the old phone. Install every update it can still get, remove accounts it doesn't need, set a PIN or fingerprint, and keep it on a charger away from the crib. If it ever leaves the house, erase it first.

When a cloud monitor is the better choice

• You want to check on the baby from work without setting up a VPN. That convenience is exactly what the maker's servers buy you.
• You never want to touch a router setting. A well-run cloud service with 2FA on is a defensible setup; it means trusting the company as well as your own house.
• Mamoon also has limits unrelated to security: one camera per parent phone, no two-way talk, no lullabies, and it is coming soon rather than in the stores today.

Frequently asked questions