Flock Safety has told its police customers that data about its devices was “unlawfully accessed and exfiltrated.” The notice, sent in late September 2026, conflicts with a January 2026 Flock blog post saying the company had never been hacked. Hartford TV station WFSB reported on September 29 that Connecticut departments received the notice. Researcher Joshua Michael posted the full text.
This briefing was prepared October 4. It covers what the notice says, not an independent review of the data.
What the notice says
According to Flock's notice, a website that went up on September 22 showed where customer devices were as of December 2025. The records included each device's name, location and type. Flock says the data came from a third-party map service and that no license plate images, video footage or CJIS data were exposed.
Flock says the person behind the site reported an exposed map access key to its security team in November 2025. The company says it fixed the problem and closed the issue in December. Flock says it saw no sign of unauthorized access at the time and has now notified law enforcement.
The site is Michael's Flock Surveillance Map. The Intercept reported on September 24 that it shows more than 300,000 Flock devices, using records Michael archived in December 2025. Our earlier brief covers the effort to get the map taken down.
What is still unconfirmed
The date Flock's map key stopped working is disputed. Flock says December 2025. Michael wrote in January that the flaw he reported was still unpatched on January 7, 2026.
The full scope is also unclear. A September 25 cease-and-desist letter from Flock's lawyers, published by Footnote 4a, says the information included proprietary and confidential material belonging to Flock and its customers. The letter doesn't identify that material.
Flock did not tell WFSB which law enforcement agency is investigating. And the January 6 blog post saying Flock had never been hacked was still online when we checked on October 4.
What residents can ask
Agencies that use Flock should have the notice. A records request can ask for Flock's notice, any follow-up correspondence, any list of the agency's own devices in the data, and the security terms in its Flock contract. Device names matter: The Intercept reported that they typically include a street address.
In Ledyard, Connecticut, the police chief told the town council the breach was one of several concerns and that he was moving to end the town's contract, WFSB reported.
Our guide, Has Flock Safety been hacked?, separates device flaws researchers demonstrated from data Flock confirmed was taken, with a dated timeline and sample request wording. FlockDetour is independent of Flock Safety and has not reviewed the leaked dataset.