Verkada to pay $2.95 million for alleged CAN-SPAM Act violations

The FTC found that Verkada failed to implement basic security controls for its cloud-managed security cameras, enabling a March 2021 intrusion (attributed in reporting to a group calling itself "APT-69420 Arson Cats") that gained admin access to the vendor platform, exposed live feeds and extracted video and customer data, and a prior December 2020 compromise where Mirai was installed to facilitate DDoS attacks; Verkada agreed to a $2.95M settlement and must implement a comprehensive security program, reporting requirements, and corrected email practices.