Flock Safety Breach: 1.6 Million Images Exposed — Is Their Network Truly Safe?

A stolen Flock Safety license-plate camera yielded roughly 1.6 million images after hackers physically removed and reverse-engineered the device, but a former Secret Service cybercrime expert says the incident does not appear to have compromised Flock’s broader cloud network. This distinction is crucial for understanding the market implications for Flock Safety and the broader public safety technology sector.

Jason Brown, director of customer advisory and counter-fraud lead at threat intelligence firm iCOUNTER, spent 25 years with the U.S. Secret Service and specialized in cybercrime, offering a veteran’s perspective on the nuances of cyber breaches.

Brown told FOX Business that the distinction between accessing one physically stolen camera and breaching Flock’s network is critical, especially when assessing the potential financial and reputational fallout.

“The biggest thing I keep hammering at home [is] that Flock was never compromised,” Brown said, emphasizing that the incident was a targeted hardware breach, not a systemic network exploit. “So there’s never been a large dump of information out of their network.” This distinction is vital for a company like Flock, operating in a sensitive public sector, where a widespread network breach could severely impact its market valuation, government contracts, and investor trust.

AUSTRALIAN PRIME MINISTER SAYS OPENAI AGENT ACCESSED GOVERNMENT HEALTH WEBSITE, RAISES ‘EXTREME CONCERN’

According to WIRED, hackers physically removed a Flock camera from above a roadway and reverse-engineered it. They reportedly discovered encrypted and unencrypted portions of the device’s storage and recovered an encryption key stored on the camera that allowed them to unlock additional data. This highlights a critical vulnerability in the physical security aspect of deployed hardware – a factor often overlooked in an increasingly cloud-centric cybersecurity discourse.

“This was a situation where somebody physically had access to a camera because they stole it off of a pole, took it home, and then did backward engineering on that camera,” Brown said, framing it as an isolated, albeit sophisticated, hardware compromise. The cost of physical asset recovery and enhanced tamper-proofing for future deployments could represent a significant operational expense for Flock, impacting margins and capital expenditure.

“That did not give them the capability to actually log into the cloud portion of Flock, and nothing in the cloud of Flock proper was accessed.” This reassurance is paramount for investors and current/prospective clients (law enforcement agencies), as a breach of the central cloud infrastructure would signal a far more catastrophic systemic failure, potentially leading to widespread data loss, legal liabilities, and a complete erosion of market confidence.

According to WIRED’s analysis, the recovered logs covered roughly 21 days of activity, including 1.6 million images, 50,200 vehicles and 27,000 short video clips. While substantial for a single device, the limited scope compared to the entirety of Flock’s distributed network helps contain the immediate damage. However, the exposure still raises questions about data retention policies on edge devices and the efficacy of on-device encryption for sensitive public data.

Flock cameras capture images and short videos of passing vehicles, which are transmitted to the company’s cloud infrastructure for processing and can then be searched by authorized law enforcement users. The perceived integrity and security of this data pipeline are fundamental to Flock’s business model and its ability to secure ongoing public contracts.

OPENAI, 100+ COMPANIES WARN OF COMING SURGE IN AI-POWERED CYBERATTACKS, CALL FOR GLOBAL DEFENSE PUSH

Former U.S. Secret Service cybercrime expert Jason Brown told FOX Business that hackers’ access to a physically stolen Flock camera did not amount to a breach of the company’s broader cloud network.(FOX Business / FOXBusiness)

Brown characterized the stolen-camera incident and an earlier security issue in which some cameras temporarily became accessible over the internet as isolated events rather than evidence, based on what he knows, of a broader compromise of Flock’s system. This narrative of “isolated incidents” is critical for managing market perception and preventing broader market contagion for companies in the IoT and surveillance space.

“They are one-off situations and don’t show a larger problem for the Flock system that I’m aware of,” Brown said, a statement that will likely be scrutinized by cybersecurity analysts and investors evaluating the company’s risk profile.

Brown said some cameras had previously been remotely accessible because of weak authentication controls, but said the issue was addressed and did not result in access to Flock’s cloud infrastructure. He added that Flock reports about 97% of law enforcement agencies using the system now have multifactor authentication enabled – a standard industry best practice that, if not widely adopted, could expose clients to significant systemic risk, impacting Flock’s overall enterprise value.

Brown also argued that the presence of a Flock camera should not change how people conduct themselves in public, asserting a societal context often debated in the public sphere. From a market perspective, public perception and regulatory attitudes toward surveillance technology directly influence its addressable market and growth trajectory. Companies like Flock operate at the intersection of public safety and privacy rights, making them susceptible to shifts in social license and legislative action.

“Should a person conduct themselves differently because a Flock camera is there? I would argue no,” he said, touching upon the ongoing ethical debate that influences public acceptance and, by extension, the market penetration of such technologies.

BANKS WARN AI SHOPPING AGENTS COULD INCREASE RISK OF SCAMS, FRAUD AND DATA PRIVACY BREACHES

Flock Safety cameras capture images and short videos of passing vehicles that can be searched by authorized law enforcement users.(Flock Safety / Unknown)

“We’ve seen good uses of the technology, where individuals, a murder is committed in one city and the individuals responsible for it were identified by Flock cameras in another city,” he continued. “You know that that’s a positive, but we all have to understand that whenever we’re out in public, we do not have a reasonable expectation of privacy. We are in public. Anybody can take a picture of us at any time. It may not be the polite thing to do, but anybody can do it at any point in time.” This argument for the societal benefit often underpins the demand for such technologies, forming the revenue base for companies in this niche.

“The debate of do you have Flock in your community – that’s a debate for the community,” Brown added, acknowledging the local political and social dynamics that can either accelerate or impede market expansion for companies like Flock Safety.

Still, Brown said the incident illustrates a broader cybersecurity issue involving third-party and supply-chain risks “that many corporations would see.” For investors, this is a critical red flag, highlighting potential systemic vulnerabilities that can impact not just one company but an entire supply chain, leading to ripple effects across various sectors. The integrity of third-party vendors and hardware suppliers is increasingly becoming a key component of enterprise risk management and due diligence.

Brown said the rapid advancement of artificial intelligence makes addressing those risks increasingly important, creating a dynamic threat landscape that demands continuous investment in cybersecurity. This implies higher operational costs for security, potentially affecting profitability and requiring companies to continuously innovate their defense mechanisms to maintain market competitiveness.

“The security posture of everything is changing by the minute,” he said, underscoring the relentless pace of cyber evolution and the constant pressure on companies to adapt.

GET FOX BUSINESS ON THE GO BY CLICKING HERE

In this photo illustration, the Flock Safety logo is being displayed on a mobile phone screen on March 20, 2025.(Osmancan Gurdogan/Anadolu via Getty Images / Getty Images)

“We have [to] gather intelligence on what is happening with the third parties and then work with those third parties before the incident even occurs to ensure that they are secure, so our customers are ultimately secured,” he continued. “And in this day of AI, the speed and the veracity of that only increases by the minute.” This proactive approach to third-party risk is not just good practice but a financial imperative to protect brand equity and long-term shareholder value in an AI-driven threat environment.

FOX Business has reached out to Flock for comment.