Unsure if this is authoritative source, but issue is worth following

http://securityaffairs.co/wordpress/51726/cyber-crime/ovh-hit-botnet-iot.html

http://arstechnica.com/security/2016/09/botnet-of-145k-cameras-reportedly-deliver-internets-biggest-ddos-ever/

Intel Security's chief technical strategist knows the score:

consumers will cheerfully give away their security and privacy in the name of convenience.

Scott Montgomery said time and time again non-geeks have shown little interest in the security of their IoT gizmos and were willing to put up with major security failings in things like home alarm systems and door locks in exchange for ease of use.

http://www.theregister.co.uk/2016/09/29/internet_of_things_security_patching/

worth a quick read

As of a few months ago, our rule for our company is everything IoT has to be on a separate network. Completely separate - different account with the ISP and everything.

Doesn't keep the devices from being hacked and used like this, but at least it keeps them on a separate network from the accounting software!

Yup. IoT stuff should never touch your actual network. Use the 3 router option I described before, with a separate IoT network, or try one of the Ubiquiti EdgeRouter products, which accomplishes the same thing.