Eiliko toy leaks 13 million conversations on Chinese servers

The Eiliko case is the latest in a series of security failures uncovered by accidental hacker Sammy Azdoufal, who this spring and summer showed similar vulnerabilities in DJI robot vacuums, Meari baby monitors, and security cameras. This time, his discovery reveals not just poor security but intentional profiling: Energize Lab's service reads conversations to build detailed profiles of users, including their profession, family, and personality traits. For example, it logged that a 52-year-old customer service worker named Lucy is 'kind, empathetic, hardworking' but 'has difficulty trusting family members.'

The company's privacy policy claims audio recordings are encrypted, transmitted to service partners like Alibaba Cloud, and deleted immediately after processing. However, Azdoufal found that audio files, photos, and full-text conversation databases were stored unencrypted at public web addresses. Many admin passwords were also among the most common, making unauthorized access trivial. Despite repeated outreach from both Azdoufal and The Verge, Energize Lab did not engage with the security concerns, leaving users unaware of the exposure.

The implications extend beyond this single toy. The data includes over 31,000 profiles belonging to children in the United States, the largest market for these robots. With hackers able to search conversations for terms like 'suicide' or retrieve photos of children, the exposed information could be used for targeting and scams. The fact that a hacker could hijack an entire fleet's personality simultaneously suggests a systemic vulnerability that could affect any connected toy with similar architecture, though it remains unclear how many other devices share these flaws.