Smart home apps that have not been updated in years are still widely used, and many keep transmitting sensitive data to servers that are no longer properly maintained. Researchers at the University of Massachusetts Amherst analyzed 61,500 abandoned Android IoT companion apps, which are the apps people use to control devices such as smart plugs, cameras, and thermostats.
The findings point to a quiet security gap: even when a vendor stops supporting an app, the app often remains functional enough to keep collecting and sending data. Because the servers on the receiving end are effectively orphaned, that data may be stored insecurely, exposed, or used in ways users never intended.
The study highlights a broader problem in the IoT ecosystem, where device support can end long before the hardware stops working. Users are left with a choice between losing functionality and continuing to run software that may be unsafe. The researchers' analysis suggests this is not a rare edge case but a widespread issue affecting millions of people.