Hacked CCTV videos from a maternity hospital in India have been sold on Telegram, police say, raising serious questions about privacy and security in a country where such cameras have become commonplace.
Earlier this year, police in Gujarat state were alerted by the media to videos on YouTube - some showed pregnant women undergoing medical exams and receiving injections in their buttocks - in a maternity hospital in a city.
The videos had a link directing viewers to Telegram channels to buy longer videos.
The director of the hospital told the BBC that the cameras had been installed for the safety of doctors. The BBC is not naming the city or hospital to protect the identity of the women in the videos. None of them have filed a police complaint.
Police say their investigation uncovered a massive cybercrime racket where sensitive footage from at least 50,000 CCTVs from across the country was stolen by hackers and sold on the internet.
CCTVs have become ubiquitous in India, especially in urban areas. They are installed in malls, offices, hospitals, schools, private apartment complexes and even inside people's homes.
Experts warn that while CCTV boosts security, poorly installed or managed systems can threaten privacy. In India, cameras are often handled by staff without cybersecurity training, and some domestically manufactured models are reportedly easily exploitable.
In 2018, a tech worker in Bengaluru city said that his webcam was hacked and that the hacker demanded payment in exchange for not sharing his private videos. In 2023, a YouTuber reportedly found out that his home CCTV had been hacked after private videos went viral.
Last year, the federal government asked states to not procure CCTVs from suppliers with a history of security data breaches and also introduced new rules to improve the cybersecurity of CCTV cameras. But hacking incidents like these are still reported.
In Gujarat, police say they ended up discovering a network of individuals spread across the country.
[They] were hacking into the video surveillance systems - or CCTV systems - of hospitals, schools, colleges, corporate offices and even the bedrooms of private individuals in multiple states, Lavina Sinha, who heads the Ahmedabad cyber crime department investigating the case, told reporters.
Hardik Makadiya, Gujarat's top cybercrime official, says videos were sold for 800–2,000 rupees ($9-22; £7-17), with Telegram channels offering live CCTV feeds via subscription.
Police have registered a case under various sections of the law, including violating a female patient's privacy, publishing obscene material, voyeurism and cyber terrorism - which is a non-bailable offence. They say that they reached out to Telegram and YouTube, and the videos have been taken down.
Since February, police have arrested eight people in the case - four from Maharashtra and others from Uttar Pradesh, Gujarat, Delhi, and Uttarakhand. They remain in judicial custody as the case proceeds in court.
Yash Koshti, lawyer for three of the accused, denied the allegations, saying they were not hackers or cyber criminals and that someone else carried out the breach.
Cybercrime investigator Ritesh Bhatia warns that weakly protected CCTV and home networks are easy targets and must be properly secured. Wireless CCTV systems help you access the footage remotely, like on your smartphone or laptop. But once a system is connected to the web, it's easy for hackers to decode its IP address and default password, he says.
One way to secure surveillance systems is to change IP addresses and the default password.
Mr Bhatia advises using a robust password and recommends periodic audits by a cybersecurity professional. He also points out that CCTV manufacturers should be clear about the need for strong passwords, similar to cigarette packet health warnings.
The director of one of the affected hospitals noted that the CCTVs in exam and injection rooms were meant to protect doctors from false allegations, and these cameras have since been removed from sensitive areas.
Despite the severity of the situation, police in Gujarat stated that neither the hospital nor any patient had formally filed a complaint; the complaint was lodged by a police officer instead.
Female patients fear that their identity will be revealed, leading to their reluctance in coming forward. Audrey Dmello from a legal center for women's rights emphasized that women often face shame in such incidents, which exacerbates the issue. When there is a sexual angle involved, the victim is re-victimized due to the patriarchal nature of Indian society, Ms. Dmello said.
