Privacy
Robot toy Eiliko accused of exposing private user data and conversations
A Verge report claims the Eiliko robot toy and its app store unprotected user data, including personal details, conversations and photos, on insecure servers. The manufacturer has not responded to requests for comment.
Ross GrantUpdated 3 min read
The short version
A report claims the Eiliko robot toy and its app collect and store personal data, including conversations and photos, on insecure servers. This data could be accessed by hackers because it is not protected. The manufacturer has not responded to questions about the issue. If true, this could put users’ privacy at risk, especially children.
What happened?
A Verge report claims the Eiliko robot toy and its app store detailed user profiles, conversations, photos and audio recordings on insecure servers in China. The data includes sensitive personal information and is allegedly accessible without protection. The manufacturer, Energize Lab, has not responded to repeated requests for comment.
What the report says
According to The Verge (opens in a new tab), the Eiliko robot toy and its app, made by Energize Lab, collect and store a wide range of personal data from users. This includes names, ages, birthdays, professions, family details, and even personality traits inferred from conversations with the toy. The data is reportedly stored on servers in China with little or no protection.
The report is based on research by Azdoufal, who says he was able to access a searchable database containing user conversations, emails, IP addresses, and even photos and audio recordings. Some of these files, including images of children and voice messages, were stored at public web addresses without encryption.
What kind of data is at risk?
The data collected goes far beyond basic app usage. The researcher found:
- Full-text logs of user conversations with the toy
- Personal profiles built from those conversations (e.g. job, family, emotional state)
- Photos (including of children) from devices with cameras
- Audio recordings of users interacting with the toy
- Email addresses and IP addresses
The Verge was able to search for sensitive topics like “suicide” and find related conversations. This kind of information could be valuable to scammers or other malicious actors.
How secure is the system?
The report claims that Energize Lab’s servers are “completely, utterly unprotected.” Admin passwords were described as weak and commonly used. The company allegedly did not respond to repeated attempts by the researcher and The Verge to alert them to the issue. The only reply was a generic customer support message, with no follow-up.
Azdoufal also demonstrated that he could remotely access and control the toy’s memory and its large language model (LLM), suggesting that attackers could manipulate what the toy says to users. In one case, the toy began making inappropriate and disturbing statements after being compromised.
What has Energize Lab said?
As of publication, Energize Lab has not issued a public statement or responded to detailed questions from The Verge. The company’s only response was a brief, automated email from customer support. There is no confirmation yet from the company or from any government agency.
What should users do?
If you own an Eiliko toy or a similar device, consider disconnecting it from the internet and uninstalling its app until more is known. Be cautious about sharing personal information with internet-connected toys, especially those that store data overseas or do not have clear privacy policies. Regulators in many countries can impose large fines for mishandling user data, especially when children are involved.
What happens next?
Azdoufal and security researcher Tod Beardsley plan to publish nine official vulnerability reports (CVEs) about Energize Lab’s products. Until then, the claims remain unconfirmed by primary sources. The story highlights the risks of buying connected toys without clear security guarantees.
Claimed vs confirmed
- Unconfirmed
Eiliko robot toys and their app store unprotected user data, including conversations, photos and audio, on Chinese servers.
Reported by The Verge based on researcher Azdoufal's findings; not confirmed by Energize Lab or other sources.
- Unconfirmed
Hackers could remotely access and control the toy’s memory and language model.
Demonstrated by researcher Azdoufal to The Verge; not independently verified.
The impact
- Money
- If confirmed, Energize Lab could face regulatory fines for mishandling personal data, especially of children. Under UK GDPR, fines can reach £17.5m or 4% of global turnover.
- Reputation
- The report could damage trust in Energize Lab and raise concerns about the safety of connected toys, especially among parents.
- Customers
- If true, users’ private conversations, photos and personal details could be exposed. Parents should consider disconnecting the toy from the internet and avoid sharing sensitive information.
Why it matters
If the claims are accurate, users’ private conversations, photos and personal details could be accessed by anyone. This is especially serious for children, who may not understand the risks. The story raises questions about the safety of internet-connected toys and the responsibilities of manufacturers to protect user data.
How does it work?
The researcher claims the toy and its app collect user data and store it on servers without proper security. Data includes conversations, personal details, photos and audio, some of which are accessible at public web addresses. Weak admin passwords and lack of encryption make it easy for attackers to access or manipulate the data.
Key points
- A Verge report claims Eiliko robot toys store unprotected user data on Chinese servers.
- Personal details, conversations, photos and audio are allegedly accessible without security.
- The manufacturer has not responded to repeated warnings from researchers and journalists.
- Sensitive data about children may be at risk if the claims are accurate.
- Security researchers plan to publish official vulnerability reports.
Sources
The Verge
Reference
