[News](/news) NurseryCam breached through dangerous vulnerability [Blog](/blog)[Breaches](/breaches)[Resources](/resources)[News](/news) # NurseryCam breached through dangerous vulnerability ##### [Edward Kost](/team/edward-kost) February 21, 2021 A dangerous vulnerability in a nursery monitoring system gave cyber criminals an opportunity to seamlessly access any live camera feed in any location. NurseryCam allows parents to remotely log into the nursery minding their child to check up on them. NurseryCam services about 40 nurseries across the UK for children aged between 5 months and 6 years. Internet of Things security prober Andrew Tierney (Cybergibbons) documented the vulnerabilities exposing NurseryCam’s [sensitive data](https://www.upguard.com/blog/sensitive-data). Tierney noted that the firewalls surrounding NurseryCams could be easily bypassed through a process known as ‘port forwarding’, allowing access to the Digital Video Recorder (DVR) installed in the targeted nursery. Whenever a parent logs into NurseryCam’s web portal or mobile application, a connection is autonomously established to their associated DVR. The credentials for such a connection are the same for all NurseryCam users: **Username:** admin **Password:**  admin888 This means anyone could directly log into any DVR and access its footage just by knowing its IP address and login credentials. These login credentials wouldn’t be hard to find either, NurseryCam has included them in a public instruction manual on their website. Tierney reported these gaping vulnerabilities to NurseryCam on 6th February, and then later tweeted them on 12th February. A parent contacted Tierney telling him that they had informed NurseryCam of the same vulnerabilities 6 years ago. The concerned parent realized that any NurseryCam could be accessed with just a few simple URL edits. NurseryCam repeatedly diluted these accusations claiming that their security framework is even safer than “online banking.” But an unknown hacker has finally forced NurseryCam to admit its shortcomings by breaching their sensitive data. The hacker accessed parent viewing accounts, acquiring email addresses, passwords, usernames, and names. The hacker wasn't a threat, the motivation behind the [cyber attack](https://www.upguard.com/blog/cyber-attack) was to force NurseryCam to raise their security standards. Dr. Melissa Kao, Director of Footfallcam - the firm behind NurseryCam, [advised BBC](https://www.bbc.com/news/technology-56141093) that the exposed vulnerabilities in this breach are different to the ones highlighted by Tierney. Thankfully, the NurseryCam hacker had noble intentions. Most hackers don't. In 2018 a threat actor assumed control of a WiFi baby monitoring system to broadcast kidnapping threats. The mortified parents rushed to the 4-month-old’s room, finding him peacefully asleep to the sinister voice spouting from the monitor speakers. NurseryCam didn’t secure their vulnerabilities for 6 years. It took multiple tweets and an actual data breach to finally convince them to significantly strengthen their security posture.  Such complacency is, unfortunately, common among vendors, placing businesses at a heightened risk of third-party attacks In the absence of certainty, organizations need to take ownership of their vendor security with [third-party attack surfacing monitoring solutions](https://www.upguard.com/product/vendorrisk). Otherwise, it may take a data breach to finally convince vendors to evaluate their security efforts. ## How secure is NurseryCam? NurseryCam provides CCTV systems and parental webcam services that allow parents to remotely view live video of their children in day nurseries and childcare centers. The company also offers website design and development services tailored to the day nursery sector. * View our free preliminary report on NurseryCam’s security posture * 13 risk factors, including email security, SSL, DNS health, open ports and common vulnerabilities [View NurseryCam's score](/security-report/nurserycam) [View score](/security-report/nurserycam) [https://www.nurserycam.co.uk/](/security-report/nurserycam) ### Sign up for our newsletter UpGuard's monthly newsletter cuts through the noise and brings you what matters most: our breaking research, in-depth analysis of emerging threats, and actionable strategic insights. ## Latest news Stay up-to-date with the latest news in cybersecurity. [](/news/hugging-face-data-breach-2026-07-20) #### [Hugging Face data breach: key facts and what we know so far](/news/hugging-face-data-breach-2026-07-20) A data breach involving Hugging Face was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 20, 2026 [](/news/ey-data-breach-2026-07-19) #### [EY data breach: what happened and what's at risk](/news/ey-data-breach-2026-07-19) A data breach involving EY was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 15, 2026 [](/news/south-florida-injury-convenient-care-data-breach-2026-07-16) #### [South Florida Injury & Convenient Care data breach exposes names and Social Security numbers](/news/south-florida-injury-convenient-care-data-breach-2026-07-16) A data breach involving South Florida Injury & Convenient Care was reported in July 2026. See incident details, impact on customers, and security measures. ##### [UpGuard Team](/team/upguard) July 15, 2026 [](/news/park-west-psychology-data-breach-2026-07-16) #### [Park West Psychology data breach: what happened and what's at risk](/news/park-west-psychology-data-breach-2026-07-16) A data breach involving Park West Psychology was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 15, 2026 [](/news/fall-river-municipal-credit-union-data-breach-2026-07-16) #### [Fall River Municipal Credit Union data breach: what happened and what's at risk](/news/fall-river-municipal-credit-union-data-breach-2026-07-16) A data breach involving Fall River Municipal Credit Union was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [](#) July 14, 2026 [](/news/npcil-data-breach-2026-07-16) #### [NPCIL data breach: World Leaks claims exposure of Kudankulam Nuclear Power Plant files](/news/npcil-data-breach-2026-07-16) A data breach involving NPCIL was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 14, 2026 [View all news](/news) ## Protect your organization Get in touch or book a free demo. [Contact sales](/demo) [Free demo](/demo) ##### Free instant security score ## How secure is your organization? Request a free cybersecurity report to discover key risks on your website, email, network, and brand. * Instant insights you can act on immediately * Hundreds of risk factors including email security, SSL, DNS health, open ports and common vulnerabilities [Free score](/instant-security-score)