Hacked CCTV videos from a maternity hospital in India have been sold on Telegram, police say, raising serious questions about privacy and security in a country where such cameras have become commonplace.
Earlier this year, police in Gujarat state were alerted by the media to videos on YouTube - some showed pregnant women undergoing medical exams and receiving injections in their buttocks - in a maternity hospital in a city.
The videos had a link directing viewers to Telegram channels to buy longer videos.
The director of the hospital told the BBC that the cameras had been installed for the safety of doctors. The BBC is not naming the city or hospital to protect the identity of the women in the videos. None of them have filed a police complaint.
Police say their investigation uncovered a massive cybercrime racket where sensitive footage from at least 50,000 CCTVs from across the country was stolen by hackers and sold on the internet.
CCTVs have become ubiquitous in India, especially in urban areas. They are installed in malls, offices, hospitals, schools, private apartment complexes and even inside people's homes.
Experts warn that while CCTV boosts security, poorly installed or managed systems can threaten privacy. In India, cameras are often handled by staff without cybersecurity training, and some domestically manufactured models are reportedly easily exploitable.
In 2018, a tech worker in Bengaluru city said that his webcam was hacked, and that the hacker demanded payment in exchange for not sharing his private videos. In 2023, a YouTuber reportedly found out that his home CCTV had been hacked after private videos went viral.
Last year, the federal government asked states to not procure CCTVs from suppliers with a history of security data breaches and also introduced new rules to improve cyber security of CCTV cameras. But hacking incidents like these are still reported.
In Gujarat, police discovered a 'network of individuals spread across the country'. They were hacking into the video surveillance systems of hospitals, schools, colleges, corporate offices and even the bedrooms of private individuals in multiple states.
Police have registered a case under various sections of the law, including violating a female patient's privacy, publishing obscene material, voyeurism and cyber terrorism - which is a non-bailable offence. They say that they reached out to Telegram and YouTube, and the videos have been taken down.
Since February, police have arrested eight people in the case from various states. They remain in judicial custody as legal proceedings continue.
Cybercrime investigator Ritesh Bhatia warns that weakly protected CCTV and home networks are easy targets and must be properly secured. He advises users to change IP addresses and the default passwords on their systems regularly to prevent hacking.
The ongoing situation highlights the need for better awareness and security when it comes to CCTV usage and handling sensitive footage, especially in environments involving personal health matters.
