In Gujarat, police say they ended up discovering a "network of individuals spread across the country".
"[They] were hacking into the video surveillance systems - or CCTV systems - of hospitals, schools, colleges, corporate offices and even the bedrooms of private individuals in multiple states," Lavina Sinha, who heads the Ahmedabad cyber crime department investigating the case, told reporters.
Hardik Makadiya, Gujarat's top cybercrime official, says videos were sold for 800–2,000 rupees ($9-22; £7-17, with Telegram channels offering live CCTV feeds via subscription.
Police have registered a case under various sections of the law, including violating a female patient's privacy, publishing obscene material, voyeurism and cyber terrorism - which is a non-bailable offence. They say that they reached out to Telegram and YouTube, and the videos have been taken down.
Since February, police have arrested eight people in the case - four from Maharashtra and others from Uttar Pradesh, Gujarat, Delhi, and Uttarakhand. They remain in judicial custody as the case proceeds in court.
Yash Koshti, lawyer for three of the accused, denied the allegations, saying they were not hackers or cyber criminals and that someone else carried out the breach.
Cybercrime investigator Ritesh Bhatia warns that weakly protected CCTV and home networks are easy targets and must be properly secured.
"Wireless CCTV systems help you access the footage remotely, like on your smartphone or laptop. But once a system is connected to the web, it's easy for hackers to decode its IP address and default password. And once they get into the system, they can see or record live footage, download it or even shut down the system," Mr Bhatia says.
He says that one way to secure surveillance systems is to change IP addresses and the default password.
Mr Bhatia advises using a robust password that mixes letters, numbers, and symbols and cannot be found in a dictionary, and recommends periodic audits by a cybersecurity professional.
He adds that CCTV manufacturers also bear responsibility, and their packaging should clearly warn users to replace default passwords with strong ones - similar to cigarette packet health warnings.
