Can smart home devices be hacked? Yes, but probably not the way you picture it. Nobody is likely to park outside your house with an antenna and take over your kettle. The real breaches are far more mundane: a reused password, a router still on its factory settings, a camera whose app account was phished months ago. We researched manufacturer security documentation, the UK’s own product security rules, and guidance from the National Cyber Security Centre to build this practical fix list. No hands-on hacking or device testing was performed.
The Short Answer: Yes, Smart Home Devices Can Be Hacked
Every smart home device is a small computer on your network, and anything on a network can be attacked. But the risk is not evenly spread. For a typical UK home, the realistic threats rank like this, from most to least likely:
| Risk | How it happens | Likelihood |
|---|---|---|
| Account takeover | A reused password from a leaked site, or no two-factor authentication on the smart home app | Highest |
| Weak router | Default admin password, old firmware, WPS left on, or ports opened for a camera | High |
| Cheap unsupported device | An off-brand camera or plug with no updates and hard-coded passwords | High |
| Old shared access | An ex-partner, former tenant, or installer whose app access was never removed | Medium |
| Phishing | A fake “your account is locked” message that harvests your login | Medium |
| Company server breach | The device maker’s cloud gets attacked, exposing accounts or stored footage | Low |
| Radio attack | Specialist equipment targeting Zigbee or Z-Wave during pairing, close to the house | Very low |
This risk ranking is based on manufacturer security documentation, NCSC publications, and the UK’s PSTI product security rules, researched in October 2026. No hands-on hacking or device testing was performed.
How a Smart Home Hack Actually Happens
Most breaches are boring, automated, and opportunistic. Bots constantly scan the internet for logins using passwords stolen from other sites, a technique called credential stuffing. When one works, your smart plug or camera can end up conscripted into a botnet used for large attacks, exactly how the infamous Mirai botnet swept up hundreds of thousands of devices with default credentials.
Phishing is the second route. A message that looks like it comes from Ring, Google Nest, or your broadband provider asks you to “verify your account”, and the link harvests your password. From there, the attacker logs into the real app as you, with no device hacking required at all.
Sometimes nobody technical is involved. Ex-partners, former flatmates, or an installer with a personal account still linked to your system simply log in with credentials they already have. And occasionally the target is not your home at all: hackers breach the device maker’s own servers, which can expose account details or cloud-stored camera footage.
11 Smart Home Security Mistakes to Fix Today
These are the mistakes behind almost every real-world smart home breach, and every one of them is fixable in minutes.
1. Reusing the same password everywhere
Credential stuffing is the number one way accounts get taken over. If the password you use for your smart home app also leaked in some old forum breach, bots will try it everywhere. Use a unique password for every smart home app and your Wi-Fi, and store them in a password manager instead of your memory.
2. Skipping two-factor authentication
Two-factor authentication (2FA) means a stolen password alone is not enough to get in. Major brands including Ring, Blink, Google, and Amazon all support it. Turn it on for every smart home account that offers it, and on the email address behind those accounts, because whoever controls that email can usually reset everything else.
3. Leaving the router on its factory settings
Your router is the front door of the home network, and in many homes it is still exactly as the installer left it. Change the router’s admin password (the settings-page login, not just the Wi-Fi password), switch the Wi-Fi to WPA2 or WPA3 with a long passphrase, and turn off WPS, the push-button pairing feature that is easy to abuse.
4. Ignoring firmware updates
Manufacturers regularly release patches for security flaws, but only if you install them. Switch on automatic updates everywhere the option exists, and check the app of each device for pending updates once in a while. If a device no longer receives updates from its maker, replace it or take it off the network rather than leaving it exposed.
5. Leaving remote access, UPnP, or port forwarding switched on
Opening router ports so you can view a camera from outside is one of the most common ways homes get compromised. The NCSC advises disabling UPnP and port forwarding unless you genuinely need them, and using the maker’s secure app for remote access instead.
6. Buying bargain devices from unknown brands
That suspiciously cheap camera or plug often ships with hard-coded passwords and receives no security updates at all. Under UK law, manufacturers must now state how long a product will get security updates, so check that information before buying. If a brand has no support page and no update history, do not put its camera on your network.
7. Putting gadgets and laptops on the same network
When a camera and a laptop share one network, a breach on the laptop can spread to the camera and back. Most modern routers can run a guest network: put visitors and smart gadgets on it, and keep the laptops and phones that hold banking apps on the main one. One compromised bulb then cannot reach your documents.
8. Letting old shared access linger
Give every person their own user account rather than sharing one login, and remove access the moment someone moves out or a contractor finishes the job. Removing one person should not mean changing the password for everyone. For locks specifically, our guide to the best smart locks for renters covers PIN management for shared homes.
9. Allowing purchases and unlocks with no PIN
Voice ordering that needs no confirmation can be triggered by guests, children, or even a TV ad. Set a purchase PIN on your smart speaker, and never allow a smart lock to open on a voice command without one. Check your lock’s access log occasionally too; unusual entries are worth investigating.
10. Letting indoor cameras watch family spaces all day
A hacked camera in the living room or hallway is a far bigger privacy problem than a hacked bulb. Use privacy zones, set indoor cameras to switch off or turn away in Home mode, and keep them out of bedrooms and bathrooms. Our Eufy vs Ring security camera comparison and our Ring vs Eufy video doorbell comparison look at how the two big brands handle local storage and privacy features.
11. Selling a device without a factory reset
Smart devices hold your Wi-Fi password, account tokens, and sometimes recordings. Before selling, gifting, or binning any gadget, perform a factory reset from its settings, remove it from your app account, and pull out any memory card. Treat the device like a phone you are handing to a stranger.
Warning Signs Your Smart Home Devices May Be Hacked
Most breaches are silent, but a few symptoms are worth acting on: the thermostat or lights change on their own, you find unfamiliar devices in your router’s client list, an app logs you out unexpectedly, camera angles or settings you never touched have moved, or your broadband suddenly slows to a crawl. If you see these, change the account password and turn on 2FA immediately, update the firmware, and check the manufacturer’s site for breach guidance. If you think someone has taken control of a device, reset it following the manufacturer’s instructions.
What UK Law Now Requires
Since 29 April 2024, the UK’s Product Security and Telecommunications Infrastructure Act has banned universal default and easily guessable passwords on consumer smart products sold in the UK, the first law of its kind in the world. Manufacturers must also publish how long a product will receive security updates and provide a way to report vulnerabilities, with fines of up to £10 million or 4% of global turnover for breaches. It does not make devices unhackable, but it removes the easiest attack of all: logging in with “admin” and a password printed in the manual.
When choosing new devices, our Matter vs Thread explainer covers how modern standards handle encryption and device certificates, which is a useful buying signal alongside the update support period. For the official UK guidance, the NCSC’s smart device guidance is the authority to bookmark.
Conclusion
Can smart home devices be hacked? Yes, but the dramatic Hollywood version almost never happens. The real breaches come from reused passwords, neglected routers, missing updates, and cheap devices nobody supports, and those are all mistakes you can fix in an afternoon. Change your passwords, switch on 2FA, update everything, and give your gadgets their own network. Do that, and your smart home is far more secure than most.
Frequently Asked Questions
Can smart home devices be hacked through Wi-Fi?
Yes, but usually through weak Wi-Fi or router settings rather than exotic attacks: a short or reused Wi-Fi password, outdated router firmware, or WPS left enabled. Use WPA2 or WPA3 with a long passphrase, keep the router updated, and put smart gadgets on a separate guest network to limit the damage if one device is compromised.
Which smart home devices are easiest to hack?
The riskiest are cheap no-brand cameras and plugs that never receive updates, followed by any device still running factory-default credentials or very old firmware. Cameras and smart locks deserve the most care because they protect your privacy and physical security; a hacked bulb is merely annoying.
Can a hacker unlock my smart lock remotely?
Only in specific circumstances: if they take over your account (reused password, no 2FA), if someone with access shares or keeps it, or if the lock’s own software has an unpatched flaw. Keep a mechanical key as a fallback, require a PIN for remote unlock, give each user their own access, and remove old users promptly.
Is it true that default passwords are now banned in the UK?
Yes. Since 29 April 2024, UK law has banned universal default and easily guessable passwords on consumer smart products, and manufacturers must state how long each product will get security updates. Check the box or product page for that support period before buying; it is now a useful sign of a trustworthy brand.
What should I do if I think my smart home device has been hacked?
Change the account password and enable two-factor authentication, update the device firmware, and review who has shared access. If you think someone has taken control of the device itself, reset it using the manufacturer’s instructions, and check the NCSC’s smart device guidance for the official steps. Then run through the 11 mistakes above so it does not happen again.
