I-Team: Flock warns CT police about a security breach, but records reveal the company ...

HARTFORD, Conn. (WFSB) - Did Flock, the company that runs license plate readers across Connecticut, have a security breach? That’s what an email sent to Connecticut Police Departments seems to imply.

The email, sent to CT Police Departments who use Flock, details a “security incident,” saying a “malicious actor” published a website, showing the location of every Flock device across the country.

The website, which the I-Team has confirmed is flocksurveillance.org , shows more than 300,000 devices.

In their email, Flock claims “This data was unlawfully accessed and exfiltrated from a third-party map service,” but stressed that no images, video or sensitive law enforcement data was exposed.

Their assurances weren’t enough for Ledyard Police Chief Ken Cruetz.

Chief Cruetz told Town Council Monday night, the security breach was one of many concerns he has the company, and he’s asked them to get out.

“The only prudent situation was to take a time out from the flock situation and move to sever our contract with them,” says Ledyard Police Chief Ken Creutz.

The I-team found Flock has known the breach, but not the extent of it, for almost nine months.

Flock’s own email says the same person who published the website reported to Flock in November that he was able to access the information.

In their email, they say they “eliminated the vulnerability, and closed the issue in December 2025,” and “at the time, there was no indication of unauthorized access to data.”

Ken Barone, who’s been studying flock for the UConn Institute for Municipal and Regional Policy, has questions.

“Why the delay in disclosure to their clients? Not necessarily even the public, but their clients are the customers,” says Barone.

In a statement to the I-Team, Flock did not answer why there was a delay only saying, “The data was accessed unlawfully. Law enforcement is investigating.”

“So, the question I would have is, has there been an independent assessment done of what other vulnerabilities might exist in the system?” says Barone.

There are also more questions transparency.

Flock said in June, there are more than 120,000 license plate reader cameras across the country. Flocksurveillence.org shows hundreds more.

In a statement, Flock said, “The information includes records for decommissioned, planned, and in-service cameras, along with integrated cameras and other flock devices. The information obtained was limited to device name, location, and device type.”

Barone argues, doesn’t the public have the right to know where these devices are?

And if it was just that information that was taken, information they were told this person had, then what crime does Flock think occurred?

“So, questions around the delay in reporting the breach to customers, why was there a delay, what specifically was breached, what specifically has been leaked, what did they do to try to prevent this from occurring in the future, I think are all questions that warrant explanation,” says Barone.

Flock did not answer our questions what law enforcement agency is investigating, or why they didn’t ask law enforcement to investigate in November.