Was Your Baby Monitor One of the 1.1 Million Exposed in 2026?

In May 2026, French security researcher Sammy Azdoufal found that roughly 1.1 million internet-connected baby monitors and security cameras — sold under more than 300 different brand names on marketplaces including Amazon — could be viewed by anyone with a free account, no password-guessing required. If you bought a budget WiFi baby monitor in the last few years, there's a real chance it runs on the affected platform. Here's what actually happened, which brands were named, and what to do about it now.

What happened in the Meari baby monitor security flaw?

The devices all shared one thing: hardware, apps, and cloud infrastructure built by Meari Technology, a manufacturer based in Hangzhou, China, that white-labels its camera platform to hundreds of storefronts. Azdoufal, testing a monitor he'd bought on Amazon, found he could access other customers' live feeds, recorded footage, and stored images across 118 countries — reportedly by extracting a single access key from the Android app, according to Cybernews' May 2026 report. Motion-alert photos were sitting on a cloud storage bucket with no authentication required at all.

Writing in The Conversation in August 2026, Anglia Ruskin University computing lecturer Erika Sanchez-Velazquez described how the researcher "could pull up other people's live and recorded footage without needing to guess a password." Meari reportedly ignored the disclosure for months before eventually paying Azdoufal a €24,000 bug bounty, per TechRepublic's coverage.

A free account was all it took to watch 1.1 million strangers' nurseries.

Which baby monitor brands were affected?

According to Consumer Reports' 2026 investigation, Meari Technology's platform underpins baby monitors sold on Amazon under brand names including Arenti, Anran, Boifun, and ieGeek, among many others worldwide. Consumer Reports noted that Meari told the outlet its U.S.-market products don't carry the same information-security risk, but the company did not provide a verifiable list of affected U.S. models before publication — so if you own a monitor from an unfamiliar or generic-sounding brand, it's worth checking directly with the manufacturer rather than assuming you're in the clear.

This is the trade-off with white-label hardware: dozens of storefronts sell what looks like a distinct product, but a flaw in one shared backend can expose all of them at once, similar to concerns raised about Chinese-manufactured camera platforms in other 2026 security camera lawsuits.

What should you do if you own one of these monitors?

• Check your brand and model
• Update app and firmware now
• Use a unique password + MFA
• Isolate it on a guest network

Consumer Reports also recommends isolating any WiFi-connected baby or pet camera on a guest network so a compromised device can't reach the rest of your home network.

Why does this keep happening with budget WiFi cameras?

Low-cost connected cameras are often built once and resold under hundreds of names, which means a single coding shortcut — a hardcoded key, an unprotected storage bucket, a missing access control — can ripple across an entire category of products at once. It's also a data problem beyond hacking: Sanchez-Velazquez notes that many monitors collect details like feeding times, sleep, and growth patterns and share them with third parties under broad partnership terms, since sleep data isn't automatically treated as sensitive medical information. Regulators are paying closer attention: the FTC's updated Children's Online Privacy Protection Rule reached full compliance on April 22, 2026, expanding what counts as a child's "personal information" to include biometric identifiers.

Is a phone-based monitor a safer alternative?

No connected device is immune to every flaw, and switching hardware isn't a guarantee. But one practical way to sidestep the white-label risk entirely is to skip buying a new no-name camera in the first place. An app like iCameraPlus turns a phone you already own — an old iPhone or Android sitting in a drawer — into a camera for the nursery: continuous recording with a private cloud archive you can browse from the web, live view, remote start and stop, and audio and video, without adding another unfamiliar manufacturer's backend to your home network. You already know the phone; you're not trusting a brand you'd never heard of until you unboxed it.

Whichever camera you use, the baseline habits from this story hold either way: strong unique passwords, updated software, and a clear sense of who — if anyone besides you — can reach the feed. For more on keeping any home camera under your own control, see our privacy guide.

Quick answers

Is my baby monitor definitely affected by the Meari flaw?
Only if it runs on Meari Technology's platform — check the brand names confirmed by Consumer Reports (Arenti, Anran, Boifun, ieGeek, and others) or contact your manufacturer directly, since Meari has not published a full, verified brand list.

Has the flaw been fixed?
Azdoufal told reporters most of the issues he found have since been patched after Meari closed the primary access hole, but there's no public confirmation every affected device received the fix, so updating your app and firmware is still worth doing.

Are all WiFi baby monitors unsafe?
No — the risk here is concentrated in shared, white-label platforms rather than WiFi cameras generally; monitors from companies that build and maintain their own firmware and disclose their security practices carry a different risk profile.

Sources

• Cybernews: "Baby monitor flaw exposes user data across 300 brands" (May 2026)
• TechRepublic: "Over 1 Million Baby Monitors, Security Cameras Exposed Through Meari Flaws" (2026)
• PetaPixel: "Anyone Could Have Been Watching Your Kids on Certain Baby Monitors" (May 11, 2026)
• The Conversation: "Can baby monitors protect children without data security risks?" (August 21, 2026)
• Consumer Reports: "Report Sparks Security Concerns About Meari Technology Baby Monitors" (2026)
• Federal Register: Children's Online Privacy Protection Rule amendments (2025–2026)