Record attack attempts on UK businesses. The cameras were the favourite target.
Over 2,000 attempts a day, per business, and the most popular way in wasn't email or the website. It was the security cameras, door entry and building systems nobody thinks of as IT.
What happened
Business ISP Beaming has published its figures for July to September 2026. The UK businesses it monitors each faced an average of 203,585 attempted cyber attacks over the three months. That's about 2,213 attempts per business, every day, and the highest quarterly figure Beaming has recorded. It's around 7% up on the same period last year.
The most targeted category wasn't email, websites or remote desktop. It was remote control services: the systems that let you manage internet-connected devices such as security cameras, door entry and building controls. Those drew an average of 193 attempts per business per day. Web services came next.
These figures describe Beaming's own monitored customers rather than every UK business, but the pattern matches what I see: automated tools scanning the whole internet, all day, looking for anything with a default password or an old flaw.
Why the cameras?
Because they're the forgotten corner. A CCTV recorder or door entry panel gets installed by a contractor, set up so someone can view it from their phone, and then left alone for years. It often:
- Still has the default password, or one the installer uses on every job.
- Never gets updated, because nobody owns it and it isn't on anyone's list.
- Sits on the same network as your laptops, server and files.
- Is reachable from the internet, often without anyone realising.
An attacker doesn't usually want your camera footage. They want a quiet way onto your network, or a device to add to a botnet. A £200 recorder can be the door into a business that spent thousands securing its email.
What this means for your business
None of these attempts are personal. Nobody chose your business. It's scanning at scale, and the businesses that get caught are simply the ones with something left open. That's good news, because it means the fixes are mostly about closing doors, not buying new products.
It's also exactly the kind of thing Cyber Essentials checks: changing default passwords, keeping devices updated, and not exposing services to the internet that don't need to be. Since April 2026 that includes routers, firewalls and other network devices, not just laptops.
Five things to check this weekend
- List everything that's plugged into your network. CCTV recorders, door entry, alarm panels, smart heating, printers, the TV in the meeting room. If it has a network cable or Wi-Fi, it counts.
- Change every default password. Use a unique, long password for each device and keep them in a password manager, not on a sticker.
- Ask how you view the cameras remotely. If the answer involves a port being opened on your router, ask your installer to switch to the manufacturer's secure app or a VPN instead.
- Update the firmware, or ask the installer to. If the device is too old to get updates any more, plan to replace it.
- Separate it from your business network. Most business routers can put cameras and building systems on their own network, so a compromised camera can't see your files.
If you'd like a quick outside view, run your domain through the free email security checker too. It's a different door, but it's the one attackers try most after these.
Sources
Not sure what's facing the internet?
I can check what your business has exposed online, from the router to the CCTV, and tell you plainly what to close.