A security researcher has demonstrated that Eiliko, a popular digital pet robot, exposes its users' most private data. According to The Verge, researcher Sammy Azdoufal was able to access a database containing 13 million conversations from tens of thousands of users, including over 31,000 profiles belonging to children in the United States. The data was stored on Chinese servers with no meaningful protection, allowing anyone with basic skills to read full transcripts of what people told the toy.
The exposed information went beyond chat logs. Energize Lab, the manufacturer, had built profiles of users based on their conversations, logging names, ages, professions, family details, and even emotional states. In some cases, photos of children and short audio recordings were stored at public web addresses, despite the company's privacy policy claiming recordings were encrypted and deleted after processing. Azdoufal also found that many admin passwords were common and easily guessable.
The Verge spent over a month trying to contact Energize Lab, emailing ten different addresses and reaching out to employees on LinkedIn. The company's only response was a generic customer-support reply, and no one stepped forward to answer questions. Azdoufal is now working with security researcher Tod Beardsley to publish nine CVE vulnerability reports for Energize Lab, but the company has not acknowledged the issue publicly.