From a Washington Post story.
Slightly different than the remote exploits that have affected CCTV equipment recently, this was initiated by someone with physical access to one of the locations. However, it would seem that the internal security of the rest of the system may be lacking, as a person gaining access to 1 site was able to set off 156 sirens across the city in a way that made it hard for officials to shut down.
This does tie into security for surveillance/access control, just because someone is on the network, or has physical access to a location does not mean they are 'trusted'. Firewalls, VPNs, and access control do not make up for poor user authentication controls.