Senators to FTC: Flock Passwords Are Already Stolen, and the Company Doesn't Require MFA
Bot Mutiny |
A Wyden-Krishnamoorthi letter documents at least 35 stolen Flock customer passwords, accounts apparently for sale on a Russian cybercrime forum, and a company that does not require multi-factor authentication.
The letter is two pages, and the most alarming sentence in it is about a search that congressional staff ran themselves.
On November 3, 2025, Senator Ron Wyden and Representative Raja Krishnamoorthi asked the Federal Trade Commission to investigate Flock Safety for negligent cybersecurity. The letter states that a congressional staff search of Hudson Rock's public database of malware-compromised accounts found passwords for at least 35 Flock customer accounts already stolen by infostealer malware. It further states that security researcher Benn Jordan provided the lawmakers a screenshot from a Russian-language cybercrime forum in which Flock accounts appear to be offered for sale.
The exposure
Flock operates the largest surveillance camera network in the United States, contracting with more than 5,000 police departments across 49 states and generating billions of vehicle scans per month, per the letter. Roughly 75 percent of its law enforcement customers have opted into a National Lookup Tool that lets any enrolled agency search every other enrolled agency's data. The letter's conclusion follows directly: anyone holding a stolen Flock password can potentially track vehicles across the country.
Flock confirmed to Congress in October 2025 that it does not require multi-factor authentication on law enforcement accounts, according to the letter. The MFA it optionally supports includes SMS codes, which are vulnerable to interception, and it does not natively support the phishing-resistant MFA that CISA calls the gold standard and that federal agencies are required to use.
The borrowed badge problem
The letter also documents what happens without MFA even when nobody steals anything. It describes a Drug Enforcement Administration officer running searches through the Flock account of a local detective in Palos Heights, Illinois, a practice the detective confirmed was common on his DEA task force, first identified by a reporter at 404 Media and detailed in records obtained by Unraveled Press. Every search a borrowed account runs is logged under the wrong officer's name, which means the audit trail that is supposed to catch misuse cannot reliably say who did the misusing.
The legal hook
The lawmakers argue the failure to require MFA is likely an unfair business practice under Section 5 of the FTC Act, noting the Commission reached that conclusion against Uber, Chegg, Drizly, and Blackbaud. They also point to California Civil Code section 1798.90.53, which requires ALPR operators to maintain reasonable security safeguards.
What the letter establishes: stolen credentials exist, credential sharing happened, and MFA is not required. What it does not establish: that any stolen Flock account has been used to track anyone. That absence is not reassurance. It is the point of the letter: with attribution this weak, nobody could tell.