Hackers from a collective called stegan0gram removed a Flock Safety camera from a roadway in Pleasant Hill, California, extracted its data, and shared findings with 404 Media and WIRED. The breach revealed the camera captured 1.6 million images over several weeks, detecting not only vehicles and license plates but also people, bicycles, and details like bumper stickers and an American flag patch on a motorcyclist's saddlebag. Despite Flock's claims of on-device encryption, hackers recovered an encryption key stored on the device, unlocking thousands of vehicle detection videos. The investigation showed Flock's computer-vision software explicitly identifies people alongside vehicles.

Flock's system sends data to company servers where license plates are read and vehicle characteristics identified, making time-stamped records searchable by local agencies. Controversially, Flock's national network allows over 2,000 agencies nationwide to access local camera data. In Alpharetta, Georgia, records were accessible to police departments, colleges, airports, and even the Office of Inspector General for the federal General Services Administration. 404 Media previously revealed local police performed lookups for Immigration and Customs Enforcement and a Texas officer searched nationwide for a woman who self-administered an abortion.

The hackers stated they "liberated hardware in the field" to reverse engineer the surveillance technology. Multiple people have been arrested for tampering with Flock cameras, prompting some towns to discontinue use while one police department created a fake 3D-printed camera case to catch vandals.