Is Your CCTV System Secure From Hackers? A Guide for NZ Businesses
CCTV can be hacked, and the most common cause is not sophisticated attacks. It is basic setup mistakes: default passwords left unchanged, outdated firmware, and cameras exposed directly to the internet. For NZ businesses, an insecure CCTV system is more than a technical problem. It can expose live footage of your premises and staff, and it can create Privacy Act 2020 obligations if footage is accessed by someone who shouldn't have it.
Key takeaways:
Most CCTV hacks come from setup weaknesses such as default or shared passwords, not advanced attacks
Internet-connected cameras and recorders need the same care as any other business IT device
The Privacy Act 2020 expects businesses to protect personal information, which includes identifiable CCTV footage
A secure system has unique logins per user, regular updates, and no cameras directly exposed to the internet
Ask any provider how footage is stored, who can access it, and how updates are handled
Can Business CCTV Systems Actually Be Hacked?
Yes. Any camera or recorder connected to a network can be targeted if it is poorly secured. The risk is highest with older systems and with systems set up by someone who didn't change the manufacturer's defaults.
This has happened in New Zealand. In 2021, 1 NEWS reported that live feeds from poorly protected NZ cameras were appearing online, including a North Island printing business whose staff were unaware their office camera feed was being shared publicly. A security company director quoted in the story said default passwords left unchanged are a common cause, and that factory defaults are often published online.
The Most Common Weak Points
1. Default or Weak Passwords
Cameras and recorders usually ship with a factory username and password. If these are never changed, anyone who finds the device online and looks up the manufacturer's default can potentially log in. Shared passwords ("everyone uses the manager login") are a related problem, because you can't tell who accessed what.
2. Outdated Firmware
Firmware is the software that runs the camera or recorder. Manufacturers release updates to fix security flaws. A system that hasn't been updated for years can carry known vulnerabilities that attackers specifically look for. This is one reason older systems are harder to secure. See our guide on upgrading from analog to IP cameras for why ageing hardware becomes a risk.
3. Cameras or Recorders Exposed Directly to the Internet
To allow remote viewing on older setups, installers sometimes open a direct path from the internet to the recorder (often called port forwarding). This can leave the device reachable by anyone scanning for it. UK National Cyber Security Centre guidance on smart cameras recommends disabling remote-access features that aren't needed, and avoiding router features such as UPnP and port forwarding that can expose devices. That guidance was written for consumers, but the same principle applies to business systems.
4. No Separation From the Rest of Your Network
If cameras sit on the same network as your point-of-sale, accounting, or staff computers, a compromised camera can become a way into everything else. Placing CCTV on its own separate network segment limits the damage.
5. Former Staff and Contractors Who Still Have Access
Logins that are never removed when someone leaves, or an old installer who still has remote access, are an easy-to-miss risk. Individual accounts make it straightforward to remove access in one step.
Why This Matters Under the Privacy Act 2020
CCTV footage that identifies people is personal information. The Privacy Act 2020 expects businesses to take reasonable steps to protect personal information from loss, misuse, and unauthorised access. If a privacy breach is likely to cause serious harm, there are notification obligations to the Privacy Commissioner and affected individuals. For the wider picture on signage, retention, and access requests, see our guide on CCTV and the Privacy Act 2020.
A Practical CCTV Security Checklist for NZ Businesses
Default passwords changed on every camera and recorder
Unique login for each person who needs access (no shared accounts)
Access removed promptly when staff or contractors leave
Firmware and software updated regularly, by someone who is responsible for it
Remote access features switched off where they're not needed
No cameras or recorders directly exposed to the internet through port forwarding
CCTV on a separate network from point-of-sale and staff computers where possible
Footage stored securely, either in a locked, access-controlled location or with a provider that can explain how it protects data
Someone in the business knows who is responsible for CCTV security
Does Cloud CCTV Change the Security Picture?
It changes where the risks sit. With a local-only recorder, you are responsible for updates, passwords, and how the device is reached from the internet. With a managed cloud service, the provider handles much of the infrastructure and updates, and cameras don't need to be exposed directly to the internet. That doesn't remove the need for strong, unique logins on your side, and it makes the provider's practices important.
Where the cloud servers are located also matters for legal jurisdiction and support. See our guide on local vs overseas cloud storage for CCTV and our comparison of cloud vs local CCTV storage.
Questions to Ask Any CCTV Provider About Security
How are cameras and recorders updated, and who is responsible for it?
Do cameras need to be exposed directly to the internet for remote viewing?
Can each user have their own login, and can I see who accessed footage?
Where is footage stored, and who can access it at your end?
What happens to my footage and access if I stop using your service?
If a provider can't answer these clearly, treat that as a warning sign.
Frequently Asked Questions
Can CCTV cameras be hacked? Yes. Internet-connected cameras and recorders can be accessed by unauthorised people if they use default or weak passwords, outdated firmware, or are directly exposed to the internet. Most incidents come from setup weaknesses rather than advanced attacks.
What is the most common way CCTV systems get hacked? Default or weak passwords are one of the most common causes. Manufacturers' factory logins are often widely known, so leaving them unchanged makes a device easy to access.
Is cloud CCTV safer than a local recorder? It depends on how each is set up. A well-managed cloud service can reduce risk by handling updates and avoiding direct internet exposure of your devices, while a poorly maintained local recorder can be a weak point. Either way, strong unique logins and regular updates remain essential.
Does the Privacy Act 2020 apply if my CCTV footage is accessed by a hacker? Footage that identifies people is personal information, and the Act expects businesses to protect it with reasonable safeguards. If a breach is likely to cause serious harm, there are notification requirements. It's worth getting advice from a lawyer or the Office of the Privacy Commissioner for your specific situation.
How often should CCTV firmware be updated? There's no single schedule, but updates should be checked and applied regularly, and someone should be clearly responsible for doing it. Systems that no longer receive manufacturer updates are a reason to consider replacement.
This article is general information, not legal or cybersecurity advice. For guidance specific to your business, speak to a qualified IT security professional or the Office of the Privacy Commissioner.
