BabyfinoDE

Can baby monitors be hacked?

Yes. Analog monitors can be overheard by anyone in range with a suitable receiver, and researchers have documented serious flaws in Wi-Fi camera monitors since 2013. How exposed you are depends on the technology and on how you set it up.

Published 21 October 2026

Yes, baby monitors can be hacked, but the risk depends heavily on the type. Analog monitors broadcast unencrypted, so anyone nearby with a suitable receiver can listen. Wi-Fi camera monitors can be reached from anywhere, and since 2013 researchers have published serious flaws in them, some letting strangers watch live video. For DECT and other digital monitors without Wi-Fi, we found no documented case of a specific model being intercepted.

What type of baby monitor can get hacked?

Type What is documented Where an attacker has to be
Analog radio Unencrypted; a suitable receiver can listen in Within radio range
DECT Original cipher broken in 2010, standard upgraded since; no documented interception of a baby monitor Within radio range
Digital 2.4 GHz (FHSS) Frequency hopping is not encryption; no documented interception Within radio range
Wi-Fi camera with cloud Many documented flaws, mostly in the vendor’s cloud and app Anywhere on the internet
Baby monitor app Anything from unencrypted to end-to-end encrypted Depends on the app

Wi-Fi and cloud cameras are where most documented problems sit, mostly in the manufacturer’s servers and apps rather than the camera itself: guessable user IDs, unprotected server interfaces, exposed keys to cloud storage. And whoever runs the servers your video passes through can see it, unless it is end-to-end encrypted [7].

Apps aren’t automatically safer. A 2023 University of Münster study of four popular Android baby monitor apps found one that sent video unencrypted, one where end-to-end encryption was optional and off by default, and one with an unencrypted control channel. The researchers rated only one as keeping video confidential [7].

Can baby monitors be hacked if they’re not on Wi-Fi?

A monitor without Wi-Fi can’t be reached over the internet, which rules out most of the documented attacks. Anyone who wants to listen in has to be within radio range [3]. But “no Wi-Fi” doesn’t mean “can’t be overheard”:

  • Analog monitors use public radio channels. Consumer NZ warns that anyone with a receiver, such as a walkie-talkie or another baby monitor, could listen in to conversations near the monitor [1]. In 2016, a Boston TV crew driving through suburbs with an off-the-shelf receiver picked up live video from several nurseries; the models weren’t named [2].
  • DECT originally made encryption optional, and researchers publicly broke its cipher in 2010 [4]. The standard has since added stronger, AES-based protection [5], but manufacturers usually don’t say whether a monitor uses it. We found no published interception of a specific DECT baby monitor.
  • Digital 2.4 GHz monitors: product listings sometimes call frequency hopping (FHSS) encryption. It isn’t. NIST says FHSS reduces interference but provides “minimal transmission security” [6]. We found no documented interception of one of these monitors either.

Documented cases

The status refers to the devices studied at the time, not to a brand’s current models.

  • 2013 and 2014 – Foscam IP cameras used as baby monitors: in Houston, a stranger shouted obscenities at a toddler and her parents [8]; in Ohio, a man shouted at a 10-month-old while the camera followed her father [9]. Foscam then shipped firmware prompting owners to change the blank default password; an available update would have fixed the Ohio camera’s flaw.
  • 2015 – Rapid7 tested nine Wi-Fi baby monitors from eight vendors: eight got an F and one a D; findings included hard-coded passwords and unencrypted video. Rapid7 knew of no active abuse; one vendor had committed to a patch [10].
  • 2018 – miSafes Mi-Cam (SEC Consult): flaws in the cloud service let an attacker view and control all connected monitors. Not fixed as of 2018; the vendor was unreachable, and SEC Consult advised against using it [11].
  • 2020 – iBaby M6S (Bitdefender): exposed credentials let attackers download clips from cloud storage and watch live. Fixed in February 2020, within 24 hours of publication [12].
  • 2021 – ThroughTek Kalay (Mandiant): a software component in IP cameras and baby monitors let anyone who knew a device’s ID watch live audio and video. Fixed from SDK 3.1.10; whether every manufacturer shipped it is unknown [13].
  • 2022 – Nooie baby monitor cameras (Bitdefender): live streams could be redirected, and other cameras’ recordings were reachable in cloud storage. Nooie reported a fix in April 2022 [14].

How often do baby monitors get hacked?

Nobody knows; no representative statistic exists. The figures that circulate measure something else – lab tests of a handful of models (nine out of nine flawed in Rapid7’s 2015 test) or internet scans of exposed cameras of every kind, most of them not baby monitors. Rapid7 declined to scan for monitors online, as that would likely have broken US law [10].

How to tell if your baby monitor is hacked

You’ll usually only notice an intruder who does something. Take these seriously:

  • Unknown voices, music or sounds from a camera with a speaker, as in the Houston and Ohio cases [8, 9].
  • A camera that pans or tilts by itself [9].
  • Unknown users, changed settings or a password that stops working. One monitor tested in 2015 let anyone add themselves as a viewer without a password [10].

Not necessarily a hack: strangers’ voices on an analog monitor may come from another device on the same public channel, which does mean others can hear you too [1]. Static or crackling on its own says nothing about an attack.

What to do if you think your baby monitor was hacked

  1. Unplug it from power and the network.
  2. Write down what happened and when, and screenshot the app.
  3. Factory-reset and update the firmware before reconnecting [15].
  4. Change passwords for the device, the manufacturer account and your Wi-Fi to unique ones; turn on two-factor sign-in if offered.
  5. Remove users and devices you don’t recognize.
  6. Turn off UPnP and port forwarding on your router if you don’t need them [15].
  7. Ask the manufacturer. If there’s no fix or no answer, take the monitor offline or replace it.

Is it safe to use a Wi-Fi baby monitor?

It can be, if the manufacturer gets security right and you set it up carefully.

Before you buy

  • End-to-end encryption for audio and video, on by default, so not even the manufacturer can watch. A claim alone isn’t proof: in 2023 a major camera brand admitted its advertised end-to-end encryption was missing in its web portal, and changed its system [16].
  • No cloud recording you don’t need. Two of the cases above exposed stored clips.
  • A track record of updates and of fixing reported flaws quickly.

When you set it up

  • Replace any default password with a strong, unique one [15].
  • Turn on automatic updates [15].
  • Disable remote viewing if you don’t need it [15].
  • Turn off UPnP and port forwarding [15].

Deciding between an app and a dedicated video monitor? Our comparison looks at the security of both.

How Babyfino handles it

Babyfino turns a spare phone or tablet into the baby unit (see using an old phone as a baby monitor). Audio and video are end-to-end encrypted: Babyfino uses WebRTC, whose standard makes DTLS-SRTP encryption mandatory, with no way to switch it off [17]. Each device also signs its key fingerprint, so not even Babyfino’s server can listen in. Media goes device to device or through a relay that only sees encrypted data, and no audio or video is stored on any server. Devices pair by QR code; there’s no account.

What that doesn’t cover: the server sees metadata such as connection times, no encryption protects a phone that is itself compromised, and Babyfino hasn’t been externally audited yet. Babyfino is coming soon for iPhone and Android.

Sources

  1. Consumer NZ: Baby monitors, 2024 (retrieved 21 October 2026)
  2. WHDH 7News Boston: Hank Investigates: Baby Monitors, 2016 (retrieved 21 October 2026)
  3. Malwarebytes: Baby monitor safety: What you need to know, 2023 (retrieved 21 October 2026)
  4. Nohl, Tews, Weinmann, FSE 2010: Cryptanalysis of the DECT Standard Cipher, 2010 (retrieved 21 October 2026)
  5. Erik Tews, TU Darmstadt: DECT Security Analysis (PhD thesis), 2012 (retrieved 21 October 2026)
  6. NIST: SP 800-121 Rev. 2, Guide to Bluetooth Security, 2017, updated 2022 (retrieved 21 October 2026)
  7. University of Münster (Schmidt, Hosseini, Hupperich): Assessing the Security and Privacy of Baby Monitor Apps, 2023 (retrieved 21 October 2026)
  8. NBC News: Hacker attempts to harass toddler through baby monitor, 2013 (retrieved 21 October 2026)
  9. Nextgov: Hijacked baby monitor in Ohio stalks terrified tot, 2014 (retrieved 21 October 2026)
  10. Rapid7: Internet-Connected Baby Monitor Security Research – FAQ, 2015 (retrieved 21 October 2026)
  11. SEC Consult: Hijacking of arbitrary miSafes Mi-Cam video baby monitors, 2018 (retrieved 21 October 2026)
  12. Bitdefender: Severe Vulnerability in iBaby Monitor M6S Camera Leads to Remote Access to Video Storage Bucket, 2020 (retrieved 21 October 2026)
  13. Mandiant: Mandiant Discloses Critical Vulnerability Affecting Millions of IoT Devices, 2021 (retrieved 21 October 2026)
  14. Bitdefender: Vulnerabilities Identified in Nooie Baby Monitor, 2022 (retrieved 21 October 2026)
  15. National Cyber Security Centre (UK): ‘Smart’ security cameras: Using them safely in your home, 2020 (retrieved 21 October 2026)
  16. MacRumors: Anker Admits Eufy Cameras Did Not Offer End-to-End Encryption as Promised, 2023 (retrieved 21 October 2026)
  17. IETF: RFC 8827 – WebRTC Security Architecture, 2021 (retrieved 21 October 2026)