Can baby monitors be hacked? What actually happened, and a two-minute check

Can baby monitors be hacked?

Yes. What stands out in the record is how ordinary the methods were. Nobody broke strong encryption. In 2017 and 2018 strangers opened about 55,000 Ring accounts with passwords leaked from other sites, the FTC found. In 2016 the Mirai botnet took over some 380,000 cameras and routers with a list of 62 factory logins, according to CISA.

The third pattern is the maker's own systems: in May 2026 one key from an app opened about 1.1 million Meari cameras, PetaPixel reported. The table lists every case we could date and source.

Checked October 28, 2026. Most cases were fixed or the product retired; the pattern is the point: the account, the maker's servers, or a device left open.

How do you know if your baby monitor has been hacked?

Look for things that need a person on the other end. Jamie Summitt in South Carolina noticed her camera panning toward her bed while everyone with the app sat at dinner. That is the clearest sign there is.

• The camera moves, or settings change, and nobody in the house did it.
• A voice or music you didn't play comes from the speaker.
• The account shows logins, shared users or phones you don't know. Most camera apps list them in the account settings.
• The status light shows live viewing while nobody in the family is watching.

Odd noises alone are often not a hack. When Nanit parents reported a voice in 2024, two outside firms found no breach; an audio bug could mimic a voice. If you see the signs above: unplug the camera, change the account password, turn on two-factor login, sign out every other device, update the firmware, then set it up again.

Can a non-Wi-Fi baby monitor be hacked?

Far less easily, and not from the other side of the world. A radio monitor has no account and nothing on the internet to find. To listen in, someone has to be within range and know what to tune to. Old analog monitors could be overheard by neighbors, Consumer Reports warned; digital ones that hop frequencies (FHSS) or use DECT are much harder. We found no documented case of a digital radio monitor being intercepted.

The trade-off is in the name: no Wi-Fi means no phone and no second parent watching. The baby monitor without Wi-Fi page covers what "no Wi-Fi" really means.

The two-minute self-check

Go down the list for the monitor you use tonight. Every "no" comes with its fix; the advice follows the UK's NCSC and the FTC.

1. Is the account password used nowhere else, with two-factor login on? Reused passwords opened the Ring and Nest accounts. Change it and turn on the second factor in the app.
2. Does the camera still get firmware updates? Turn on automatic updates. If the maker stopped, as Wyze did for the first Wyze Cam, replace it.
3. Have the camera's and the router's factory passwords been changed? That was Mirai's whole toolkit. Change both, and the Wi-Fi password too, on WPA2 or WPA3.
4. Are UPnP and port forwarding off on the router? They let the internet reach the camera's login page. For viewing from outside, use a VPN such as Tailscale instead.
5. Is the phone by the crib locked, updated and signed out of your e-mail? An old phone as the monitor is safe with a screen lock and only the accounts it needs.
6. Do you know where your video goes? Only your home, or a company's servers? The answer decides which of the doors above are open at all.

Does the brand matter?

Less than you'd think. The cases in the table come from China and the US alike. What matters is whether video passes through the maker's servers, and whether the camera works without them. Who owns each brand and where its servers are is in our brand-by-brand table; how a camera compares with a monitor is in security camera vs baby monitor. The makers’ own words: baby monitor privacy.

What does the law now require of a baby monitor?

Two rules took aim at the doors in the table. Since April 29, 2024, a smart device sold in the UK must have a password that is unique or set by you, never a shared factory one. The maker must publish a way to report flaws and how long it will ship security updates. Since August 1, 2025, radio equipment sold in the EU, baby monitors included, must meet cybersecurity and data-protection rules, even without an internet link.

• Before you buy, look for the update period on the box or the maker's site. No date means no promise.
• Older cameras predate these rules: change their factory password yourself.

Where Mamoon fits

Mamoon has no account to steal and no cloud to leak, the two doors behind the biggest cases: picture and sound go from the phone or camera by the crib to your phone over your home Wi-Fi. Cry detection runs on the phone itself. Away from home it works only through Tailscale, an encrypted VPN, never an open port. Sound and cry alerts are free; the picture is $29.99 once or $3.99 a month after 14 days free.

Frequently asked questions

How these pages are made: an AI model drafts them from our own tests, real app screens and the sources listed, and Jan Drábek checks every page before it goes live.