NurseryCam Breach Exposes 10,585 Parent Email Addresses
What Happened — In February 2021, security flaws in the NurseryCam remote‑monitoring platform led to the exposure of 10,585 parent email addresses. The compromised data were submitted to Have I Been Pwned and the service was subsequently shut down.
Why It Matters for Trust & Control Assurance
- Highlights the risk of inadequate third‑party security controls and the need for continuous vendor oversight.
- Demonstrates why organizations must collect and retain evidence of vendor risk assessments to satisfy audit requirements.
- Reinforces the value of a defensible control‑assurance program that can quickly surface and remediate supplier weaknesses.
Who Is Affected – Parents using NurseryCam (consumer SaaS for early‑childcare monitoring).
Recommended Actions – Review your third‑party risk management program, gather security evidence from all vendors, and implement continuous monitoring of vendor controls to maintain audit‑ready posture. Source: HIBP breach report
Technical Notes – The breach stemmed from multiple security flaws in the web‑application stack; no specific CVE was disclosed. Exposed data were limited to email addresses. Source: HIBP breach report