Hacked CCTV videos from a maternity hospital in India have been sold on Telegram, police say, raising serious questions about privacy and security in a country where such cameras have become commonplace. Earlier this year, police in Gujarat state were alerted by the media to videos on YouTube - some showed pregnant women undergoing medical exams and receiving injections in their buttocks - in a maternity hospital in a city. The videos had a link directing viewers to Telegram channels to buy longer videos. The director of the hospital told the BBC that the cameras had been installed for the safety of doctors. The BBC is not naming the city or hospital to protect the identity of the women in the videos. None of them have filed a police complaint. Police say their investigation uncovered a massive cybercrime racket where sensitive footage from at least 50,000 CCTVs from across the country was stolen by hackers and sold on the internet. CCTVs have become ubiquitous in India, especially in urban areas. They are installed in malls, offices, hospitals, schools, private apartment complexes, and even inside people's homes. Experts warn that while CCTV boosts security, poorly installed or managed systems can threaten privacy. In India, cameras are often handled by staff without cybersecurity training, and some domestically manufactured models are reportedly easily exploitable. In 2018, a tech worker in Bengaluru said that his webcam was hacked, and that the hacker demanded payment in exchange for not sharing his private videos. In 2023, a YouTuber reportedly found out that his home CCTV had been hacked after private videos went viral. Last year, the federal government asked states to not procure CCTVs from suppliers with a history of security data breaches and also introduced new rules to improve cyber security of CCTV cameras. But hacking incidents like these are still reported.
In Gujarat, police say they ended up discovering a 'network of individuals spread across the country'. '[They] were hacking into the video surveillance systems - or CCTV systems - of hospitals, schools, colleges, corporate offices, and even the bedrooms of private individuals in multiple states,' Lavina Sinha, who heads the Ahmedabad cybercrime department investigating the case, told reporters. Hardik Makadiya, Gujarat's top cybercrime official, says videos were sold for 800–2,000 rupees ($9-22; £7-17), with Telegram channels offering live CCTV feeds via subscription. Police have registered a case under various sections of the law, including violating a female patient's privacy, publishing obscene material, voyeurism and cyber terrorism - which is a non-bailable offence. They say that they reached out to Telegram and YouTube, and the videos have been taken down. Since February, police have arrested eight people in the case - four from Maharashtra and others from Uttar Pradesh, Gujarat, Delhi, and Uttarakhand. They remain in judicial custody as the case proceeds in court. Yash Koshti, lawyer for three of the accused, denied the allegations, saying they were not hackers or cyber criminals and that someone else carried out the breach. Cybercrime investigator Ritesh Bhatia warns that weakly protected CCTV and home networks are easy targets and must be properly secured. 'Wireless CCTV systems help you access the footage remotely, like on your smartphone or laptop. But once a system is connected to the web, it's easy for hackers to decode its IP address and default password. Once they gain access, they can see or record live footage, download it or even shut down the system,' Mr Bhatia stresses. He advises changing IP addresses and the default password and using robust passwords. He adds that CCTV manufacturers also bear responsibility, and their packaging should clearly warn users to replace default passwords with strong ones. The director of one of the affected hospitals told the BBC the CCTVs in exam and injection rooms were meant to protect doctors from false allegations, and cameras have since been removed from sensitive areas. Police in Gujarat told the BBC that neither the hospital nor any patient had come forward to file a formal complaint, with one officer explaining that 'female patients fear that their identity will be revealed. Therefore, they are not willing to lodge a complaint.' Audrey Dmello of Majlis, a legal center for women's and children's rights, emphasizes the need to secure surveillance systems, especially in sensitive areas. 'It's an absolute must,' she states.
In Gujarat, police say they ended up discovering a 'network of individuals spread across the country'. '[They] were hacking into the video surveillance systems - or CCTV systems - of hospitals, schools, colleges, corporate offices, and even the bedrooms of private individuals in multiple states,' Lavina Sinha, who heads the Ahmedabad cybercrime department investigating the case, told reporters. Hardik Makadiya, Gujarat's top cybercrime official, says videos were sold for 800–2,000 rupees ($9-22; £7-17), with Telegram channels offering live CCTV feeds via subscription. Police have registered a case under various sections of the law, including violating a female patient's privacy, publishing obscene material, voyeurism and cyber terrorism - which is a non-bailable offence. They say that they reached out to Telegram and YouTube, and the videos have been taken down. Since February, police have arrested eight people in the case - four from Maharashtra and others from Uttar Pradesh, Gujarat, Delhi, and Uttarakhand. They remain in judicial custody as the case proceeds in court. Yash Koshti, lawyer for three of the accused, denied the allegations, saying they were not hackers or cyber criminals and that someone else carried out the breach. Cybercrime investigator Ritesh Bhatia warns that weakly protected CCTV and home networks are easy targets and must be properly secured. 'Wireless CCTV systems help you access the footage remotely, like on your smartphone or laptop. But once a system is connected to the web, it's easy for hackers to decode its IP address and default password. Once they gain access, they can see or record live footage, download it or even shut down the system,' Mr Bhatia stresses. He advises changing IP addresses and the default password and using robust passwords. He adds that CCTV manufacturers also bear responsibility, and their packaging should clearly warn users to replace default passwords with strong ones. The director of one of the affected hospitals told the BBC the CCTVs in exam and injection rooms were meant to protect doctors from false allegations, and cameras have since been removed from sensitive areas. Police in Gujarat told the BBC that neither the hospital nor any patient had come forward to file a formal complaint, with one officer explaining that 'female patients fear that their identity will be revealed. Therefore, they are not willing to lodge a complaint.' Audrey Dmello of Majlis, a legal center for women's and children's rights, emphasizes the need to secure surveillance systems, especially in sensitive areas. 'It's an absolute must,' she states.
