Breach Disclosure: NurseryCam

NurseryCam, a daycare video monitoring product, was highlighted by a security researcher to be insecure, according to a blog post made on 12 February 2021. The product had a number of vulnerabilities that affected the security of the product, and the researcher obtained a list of usernames from this service. Approximately 10,000 records were exposed, and the service subsequently shut down as a result of this disclosure.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

According to a report by The Register, the researcher disclosed a number of vulnerabilities related to how the service stored and transmitted it's data, as well as privacy issues related to the service. The disclosure came after the same researcher, Cybergibbons, reported vulnerabilities in a separate service owned by a company that owns NurseryCam.

As of the time of writing of this advisory, there is no indication of malicious activity surrounding the data being used maliciously, rather the researcher enumerated this data set and disclosed it to the security community.