Your secrets aren’t safe with this cute robot toy — they’re on Chinese servers ready to be hacked
A security researcher found that Energize Lab’s Eiliko robot toy exposed users’ conversations and personal profiles through an unprotected service. The breach matters because the toys are used by children and can collect sensitive details that could put users at risk of scams or privacy violations.
The researcher said the system gave access to about 13 million conversations and profiles for a worldwide fleet of 68,000 toys, including more than 31,000 profiles belonging to children in the United States. Stored information reportedly included names, ages, family details and personality assessments, alongside searchable transcripts, some children’s photos and audio clips at public web addresses. The company’s privacy policy says recordings are encrypted, but the article says the exposed material was not adequately protected.
- Eiliko’s service exposed millions of conversations.
- Data included personal profiles and children’s information.
- Some photos and audio were stored at public web addresses.
New here? Start with this
Eiliko is a small interactive robot toy made by Energize Lab. Toys that talk with their owners may collect conversations and profile details to personalise their responses; when children use them, that information can include personal details about their lives.
The reported exposure involved data held on a service connected to the toys, including conversation transcripts and profile information. The concern is that personal details, photos or audio could be viewed or misused if data is not properly protected. Such information can create privacy risks and may help someone target users with scams.