Cloudflare Downplays Verkada Inc. Hacking; Says, Data Not Compromised

Days after hackers broke into Valley startup Verkada Inc., gaining access to live feeds of 150,000 surveillance cameras inside hospitals, companies, police departments, prisons and schools.

Cloudflare on Thursday released a statement saying that they use Verkada cameras in their San Francisco, Austin, New York, London and Singapore offices. And all these cameras are used at the entrances, exits and main thoroughfares of their offices which have been part of security offices that have been ‘closed for almost a year. 

Further, Cloudflare said, “To be clear: this hack affected the cameras and nothing else. No customer data was accessed, no production systems, no databases, no encryption keys, nothing. Some press reports indicate that we use a facial recognition feature available in Verkada. This is not true. We do not.”

Moreover, they further ensured that their internal systems follow the same ‘Zero Trust’ model and their corporate office networks are not completely trusted by other locations or data centres. 

For example, a claim surfaced on Twitter that it might have been possible to access Cloudflare CEO Matthew Prince’s laptop. However, this claim was refuted by Cloudflare saying that Matthew wasn’t in their San Francisco office.

Another claim made by the hackers was that the attackers had a ‘root shell inside Cloudflare’s network.’

Cloudflare said that the fact that the attacker had access to a machine inside the corporate network, didn’t give them access to anything sensitive. What was seen on the footage was similar to what a visitor at the Cloudflare office would see.