Hacked CCTV videos from a maternity hospital in India have been sold on Telegram, police say, raising serious questions about privacy and security in a country where such cameras have become commonplace.

Earlier this year, police in Gujarat state were alerted by the media to videos on YouTube – some showed pregnant women undergoing medical exams and receiving injections in their buttocks – in a maternity hospital in a city.

The videos had a link directing viewers to Telegram channels to buy longer videos.

The director of the hospital told the BBC that the cameras had been installed for the safety of doctors. The BBC is not naming the city or hospital to protect the identity of the women in the videos. None of them have filed a police complaint.

Police say their investigation uncovered a massive cybercrime racket where sensitive footage from at least 50,000 CCTVs from across the country was stolen by hackers and sold on the internet.

CCTVs have become ubiquitous in India, especially in urban areas. They are installed in malls, offices, hospitals, schools, private apartment complexes and even inside people’s homes.

Experts warn that while CCTV boosts security, poorly installed or managed systems can threaten privacy. In India, cameras are often handled by staff without cybersecurity training, and some domestically manufactured models are reportedly easily exploitable.

In 2018, a tech worker in Bengaluru city said that his webcam was hacked, and that the hacker demanded payment in exchange for not sharing his private videos. In 2023, a YouTuber reportedly found out that his home CCTV had been hacked after private videos went viral.

Last year, the federal government asked states to not procure CCTVs from suppliers with a history of security and data breaches and also introduced new rules to improve cyber security of CCTV cameras. But hacking incidents like these are still reported.

In Gujarat, police say they ended up discovering a “network of individuals spread across the country”.

“They were hacking into the video surveillance systems – or CCTV systems – of hospitals, schools, colleges, corporate offices and even the bedrooms of private individuals in multiple states,” Lavina Sinha, who heads the Ahmedabad cyber crime department investigating the case, told reporters.

Hardik Makadiya, Gujarat’s top cybercrime official, says videos were sold for 800–2,000 rupees ($9-22; £7-17, with Telegram channels offering live CCTV feeds via subscription.

Police have registered a case under various sections of the law, including violating a female patient’s privacy, publishing obscene material, voyeurism and cyber terrorism – which is a non-bailable offence. They say that they reached out to Telegram and YouTube, and the videos have been taken down.

Since February, police have arrested eight people in the case – four from Maharashtra and others from Uttar Pradesh, Gujarat, Delhi, and Uttarakhand. They remain in judicial custody as the case proceeds in court.

Yash Koshti, lawyer for three of the accused, denied the allegations, saying they were not hackers or cyber criminals and that someone else carried out the breach.

Cybercrime investigator Ritesh Bhatia warns that weakly protected CCTV and home networks are easy targets and must be properly secured.

“Wireless CCTV systems help you access the footage remotely, like on your smartphone or laptop. But once a system is connected to the web, it’s easy for hackers to decode its IP address and default password. And once they get into the system, they can see or record live footage, download it or even shut down the system,”  Bhatia says.

He says that one way to secure surveillance systems is to change IP addresses and the default password.

Bhatia advises using a robust password that mixes letters, numbers, and symbols and cannot be found in a dictionary, and recommends periodic audits by a cybersecurity professional.

He adds that CCTV manufacturers also bear responsibility, and their packaging should clearly warn users to replace default passwords with strong ones – similar to cigarette packet health warnings.

Mr Makadiya told the BBC that many of the hacked CCTVs used default passwords – like Admin123 – or weak ones.

“The hackers used brute force (the use of certain programmes to generate thousands of letter-number password combinations) to break into these systems and access videos,” he said.

Audrey Dmello of Majlis, a legal centre for women’s and children’s rights, highlights the ubiquity of CCTVs in India, often installed without consent. She urges organisations, especially in sensitive spaces, to ensure their systems are properly secured.

“Organisations and institutions that set up surveillance systems, especially in sensitive spaces, must see to it that their systems are adequately secured. It’s an absolute must,” she says.

The director of one of the affected hospitals told the BBC the CCTVs in exam and injection rooms were meant to protect doctors from false allegations. He added that the cameras have since been removed from sensitive areas.

Police in Gujarat told the BBC that neither the hospital nor any patient had come forward to file a formal complaint. The complaint was finally lodged by a police officer.

“Female patients fear that their identity will be revealed. Therefore, they are not willing to lodge a complaint,” said an officer.

Ms Dmello says that the shame women face around such incidents only adds to its horrific nature.

“When there is a sexual angle involved, the victim is re-victimised because of the patriarchal nature of Indian society. If we want women to assert their rights and we want criminals to be brought to justice, we, as a society, should first stop shaming and blaming women for the crime,” she says.

[BBC]

A multi-agency search is continuing on Sunday off the coast of the Republic of Ireland for a missing Royal Navy crew member.

The Irish Coast Guard Maritime Rescue Sub Centre at Malin in County Donegal said it is continuing to coordinate the search.

The search is being conducted by Irish Coast Guard aircraft alongside the Irish Air Corps, the RNLI, the Royal Navy vessel and others.

The Irish Department of Transport (DoT) said the crew member was last seen at about 22:30 (local time) on Friday when the boat was near Tory Island, County Donegal.

[BBC]