The Verge reports exposed data in Eiliko robot toy service

The Verge reports that a security researcher found an exposed database connected to Eiliko, a robot toy made by Energize Lab. The researcher, Sammy Azdoufal, said he could access 13 million conversations from tens of thousands of users and data linked to nearly 68,000 toys.

According to the report, the database included user profiles built from conversations, with details such as names, ages, birthdays, professions, family relationships and emotional descriptions. More than 31,000 profiles in the United States belonged to children, the data reportedly showed. The service also held email addresses and IP addresses, as well as searchable conversation transcripts.

The Verge says Azdoufal found some children’s photos and short audio recordings at public web addresses. The recordings were stored despite Energize Lab’s privacy policy saying recordings are encrypted, sent to service partners such as Alibaba Cloud for processing, and deleted immediately afterward. The report also says some administrative passwords were weak.

The Verge says it and Azdoufal contacted Energize Lab over more than a month, but received no substantive response to questions about the exposure. The report says Azdoufal was also able to remotely access the toy’s memory and take control of its language model. These findings are attributed to Azdoufal and The Verge’s reporting.