Has Your Smart Home Been Hacked?

Before any technical step, be honest about who could be doing this, because the answer changes what is safe to do next. If a current or former partner set up your smart locks, cameras, thermostat, or speakers, the same access that runs the home can be turned into a weapon: doors locked or unlocked from afar, the heat cranked uncomfortably high, cameras and microphones used to watch and listen, lights and music switched to unnerve you. This is a recognized form of domestic abuse, and the cruel part is that the person who installed the system often keeps control the other person cannot override. If that describes your situation, treat it as a danger to your physical safety, not merely a privacy nuisance.

Lead with a plan. If you are in immediate danger, call 911. To think it through with someone trained in it, contact the National Domestic Violence Hotline at 1-800-799-7233, which is confidential and available around the clock, and review the safety resources from the U.S. Department of Justice Office on Violence Against Women. One warning the vendor articles never give: if an abuser is watching the system, suddenly changing every password or factory-resetting a device can tip them off and escalate the situation, so the lock-down steps further down this page should follow a safety plan, not precede it. Preserve what is happening as evidence, screenshots of the alerts, logs of when devices acted up, photos of the panels, because that record is what lets police and a protective-order petition treat it seriously.

The image of a hooded stranger breaking in from across the world makes for dramatic headlines, but it is not where most smart-home trouble starts. The far more common reality is that the access was handed out, openly or quietly, to someone with a connection to you, and never fully taken back. Working through that list calmly is more productive than imagining a phantom intruder.

A current or former partner. If they set up the hub, the app, or the accounts, they may still be a member, an admin, or simply know the master password. Shared logins from a relationship rarely get untangled cleanly at the breakup.

The person who sold you the house. Built-in cameras, doorbells, thermostats, and locks are frequently left paired to the previous owner’s account at closing. Until the device is fully removed from their account and factory-reset, their app can still see and control it.

The installer or smart-home contractor. A professional who configured the system sometimes retains an administrator profile or a service account that was never revoked once the job ended.

A former roommate, guest, or family member. Anyone you once added for convenience, a houseguest given the Wi-Fi password, a roommate added to the camera app, an adult child with the door code, keeps that access until you remove it.

A genuine outside attacker. This does happen, usually through a reused or breached password, a default device password never changed, or an unpatched device, which is why the lock-down steps matter even when you suspect someone you know. The point is not to accuse anyone; it is to narrow the field so the technical cleanup and any report to police are aimed at the right person.

From an identifier to a person. Most smart-home intrusions leave a thread to pull: an account email or phone number you do not recognize, the name of a prior owner on the closing paperwork, the business name of the installer, a username on a shared profile, or the contact details of an ex who set the system up. Each of those is a starting point. Through lawful public-records research and skip tracing, our investigation team works an email, a number, or a name into a verified identity, a current address, and known associates. The same approach behind connecting a phone number to a real person and identifying an unknown caller applies when the number is one that keeps appearing in your account’s login history.

From a person to proof police can use. Identification is not the end; it is what makes the rest possible. A named, located individual lets a detective open or advance a case, gives a court a respondent for a protective order, and supports a civil claim. Where the harassment spills beyond the home, our work on a suspicious vehicle seen on the property or tracing a plate back to its registered owner can corroborate who is showing up in person, and reviewing a person’s public social-media footprint can line their movements up with the timestamps in your device logs. We work strictly for lawful, permissible purposes. We never hack, never access an account or device, and we tell you honestly what the records can and cannot establish. If your goal is also to harden yourself against being found and watched again, our guide on reducing your own searchable footprint is a practical next step.

Whatever fragment you have is worth sending, even if it feels like nothing: an unfamiliar account email, a phone number from a login alert, the name of the people you bought the house from, the company that wired the place, or a username on a shared device. Our team researches it lawfully and tells you plainly what the public record supports. The same skill set powers our broader people-search work and full skip tracing services, and we apply it here only for legitimate, permissible purposes, never to help anyone surveil another person. For a legitimate matter, an initial locate typically comes back within 24 hours.