And that’s why you change the default password.
Mar. 16, 2026, 5:23 pm
2 min. read
Pedestrians cross East Colfax Avenue, Sept. 7. 2017. (Kevin J. Beaty/Denverite)
Denver officials confirmed Monday that someone hacked into two crosswalk devices on East Colfax Avenue to broadcast anti-Trump messaging over the weekend.
One of the signals injected messages like “[expletive] Trump” and “Trump murders children” into its usual announcements about the walk signal, according to a video circulating on social media. The announcements were made in the device’s artificial voice.
But how do you hack a walk signal? City officials said they fell victim to a common mistake: Failing to change the default password.
“These crosswalk push-buttons were newly installed,” explained public works spokesperson Nancy Kuhn in a statement to Denverite and other media.
The devices were “still bagged and with their factory settings,” including a default password “that we now have learned is easy to find online.” The push-buttons weren’t meant to be turned on yet, but had recently been connected to power.
The city shut down one hacked device at Colfax Avenue and Pearl Street on Friday night, then disconnected another at Washington Street, Kuhn said. The city has since changed the passwords of its new crossing signals.
A similar stunt happened in California last year when Caltrans failed to change its crosswalk signal passwords. In that case, experts said the systems were accessible via Bluetooth, meaning anyone with a modern phone could connect and try to guess the password. Older crosswalk signals can only be hacked by physically opening a box, the Palo Alto Daily Post reported.
The same thing can happen if you leave a default password on your home router and other devices, so, don’t say you weren’t warned.