Ahmedabad: A failure to change default CCTV passwords after installation once again exposed serious privacy risks after a doctor running a clinic in Paldi was blackmailed using private footage accessed remotely. Police on Saturday arrested Abdul Wahab Saiyed (32), a resident of Kodinar, who earlier worked as a CCTV installer and later exploited retained login credentials to access the clinic’s surveillance system.According to police, the accused remotely accessed CCTV cameras installed inside the doctor’s cabin and obtained footage showing the complainant undergoing a body massage. The video was later used to threaten and extort money. “We registered a cybercrime case. The accused accessed the CCTV of the complainant’s office. When the doctor was having a body massage, the accused obtained the video and began threatening him. He initially demanded Rs 40,000, of which Rs 5,000 was paid. When further demands were made, the complainant approached police,” said a senior police officer.The incident came to light after the doctor began receiving WhatsApp messages from an unknown number containing video clips from inside his clinic, along with QR codes for online payment. The sender warned that the footage would be shared on social media and local community groups if money was not paid. The doctor initially blocked the number but continued receiving messages from other accounts. Fearing reputational damage, he paid Rs 5,000 online before approaching Paldi police when threats escalated.During interrogation, Saiyed told police that he earlier worked with a CCTV installation firm and personally installed cameras at the complainant’s clinic. Although his job ended long ago, the doctor never changed the admin ID and password, allowing the accused to retain access. Police said Saiyed later worked as a labourer at a poultry farm and resorted to blackmail after his children fell seriously ill and he needed money for treatment. Investigators said the case bore similarities to earlier CCTV hacking incidents, including the Rajkot hospital case, where sensitive footage from inside a medical facility was accessed after installers retained credentials. In that case too, police flagged negligence in password management as a major vulnerability.Police recovered mobile phones used in the crime and are checking whether the accused accessed other locations using the same method. A case was registered under relevant sections of the IT Act and BNS for extortion, criminal intimidation and cyber offences.
