As if you needed another reason not to put an internet-connected microphone in your child's bedroom.
A California-based toy company selling "a message you can Lena Paul - The Next Morninghug" reportedly exposed over 2 million voice messages recorded between parents and children to online hackers. What's worse, the company was allegedly notified multiple times that additional customer data was online and available for anyone to grab — yet the data remained up for at least a week with evidence suggesting that it was stolen more than once.
Spiral Toys specializes in internet-connected toys, and its CloudPets line of stuffed animals represents what is becoming a trend in the toy industry: dolls that don't rely on a kid's imagination. Instead, products with names like "Talking Puppy" connect a child and relatives via the internet and allow them to send recorded voicemails back and forth.
SEE ALSO: A university was attacked by its lightbulbs, vending machines and lamp postsAccording toMotherboard, sometime in early January hackers accessed and stole customer emails and hashed passwords from a CloudPets database. Unfortunately for everyone involved, CloudsPets had no password strength requirements for its users. Security researcher Troy Hunt believes that as a result it would have been simple to guess many of the passwords, giving attackers access to customers' full accounts.
Just how many user accounts were exposed? Hunt thinks likely over 820,000.
"[In] CloudPets' case, that data was stored in a MongoDB that was in a publicly facing network segment without anyauthentication required and had been indexed by Shodan (a popular search engine for finding connected things)," wrote Hunt on his blog. "Unfortunately, things only went downhill from there. People found the exposed database online."
"The CloudPets data was accessed many times by unauthorised parties before being deleted and then on multiple occasions, held for ransom," he added. "Unauthorised access must have been detected but impacted parents were never notified."
Mashablereached out to email addresses listed on both CloudPets' and Spiral Toys' websites for comment, but both messages bounced back. We also called a publicly listed number for the company's Agoura Hills, CA, headquarters, but the phone number appeared dead.
"You must assume data like this will end up in other peoples' hands"
Needless to say, the team responsible for allegedly allowing hackers to access hundreds of thousands of customer accounts doesn't appear to have its act together.
While the audio recordings weren't themselves kept on the open MongoDB, Motherboard reports that they were stored as audio files on an open Amazon S3 bucket. This means that all one had to do was guess the correct URL and someone with malicious intent could then listen to the recordings.
Hunt concluded his blog post with less than reassuring words for worried parents, writing that "you mustassume data like this will end up in other peoples' hands. Whether it's the Cayla doll, the Barbie, the VTech tablets or the CloudPets, assume breach."
Perhaps something to keep in mind the next time you're shopping for the latest internet-connected toy for Junior.
Topics Cybersecurity
Big-League Bluster
Alibaba says its math
Temu’s Chinese suppliers protest in Guangzhou over penalty policy · TechNode
EVs overtake monthly gasoline car sales for first time in China · TechNode
The Mismeasure of Media
China’s JAC on hiring spree as EV partnership with Huawei revs up: report · TechNode
'House of the Dragon' renewed for Season 3
'Bridgerton' Season 3 is fun, but I can't get past this 1 plot hole
Contingent No More
TikTok links up with Amazon for in
Against Fear
Alibaba launches Sora
NASA's megarocket is moon
WeChat tests breaking news alerts as it looks to enrich real
Virtual Reality: The True Cost of Admission (and Why It Doesn't Matter)
BeReal acquired by Voodoo for a huge chunk of change
Insta360 launches GO 3S, a tiny 4K action camera with Apple's Find My
China’s Neta launches three electric car models in Brazil · TechNode
Episode 4: The Wave of the Future
Apple surges past Microsoft to become the world's most valuable company
Cows casually stroll through a woman's front yard in ScotlandSnapchat to eliminate local stories in citiesITT Tech is the latest casualty of the federal forTake a look at the Hot Wheels AI Intelligent Race SystemKaepernick jersey sales skyrocket following controversyObama nominates first MuslimEven Trump seemed to defend Obama after the president of the Philippines insulted himMartin Shkreli ordered to pay his 'League of Legends' team's coach $25,0006 'Titanfall 2' trailers highlight each of the game's mechsHere's how Tencent's $599 million new headquarters looks50 dope Instagram pictures from Burning Man 2016'Picnic at Hanging Rock' to be made into a spooky six part miniStudent's senior portrait is seriously on fleek thanks to his genius trick21st Century Fox settles Roger Ailes lawsuit for $20 millionDelta launches Snapchat account with a Los Angeles scavenger huntPrince Charles blasts Twitter for posing 'mortal threat' to written EnglishThis tougherThe gimmicky LG V20 is the first Android Nougat smartphone'Pokémon Go' manages to hurt religious sentiments in India even before official launchProtesters allied with Black Lives Matter shut down London City Airport runway Oracle wants to buy TikTok's U.S. business, too, report claims Ed Sheeran is fed up with Twitter for a depressing reason Annabelle comes for the 'Doctor Strange' director on Twitter Kylie and Kendall Jenner may get sued by The Doors over their T Marge Simpson wades into politics to call BlackBerry 5G smartphone with physical keyboard is coming next year People lined up at midnight and took out extra cash for the first day of legal weed in Nevada Brilliant dog hack keeps pups safe but makes them look ridiculous Man pulls bizarre Princess Diana shrine prank on roommate, goes viral Photos give glimpses into the long struggle to secure women's suffrage Will TikTok end up in the hands of Trump supporters? GOP senator compares health care to porcupine sex because nothing matters anymore Despite being barred, foreigners in Singapore found ways to join city's only pride event 15 best tweets of the week, including hilarious Cardi B edits 'The Crown' has found its Princess Diana for Seasons 5 and 6 'High Score' Review: Netflix video game documentary is quirky and fun Amazon Prime prevents users from using swear words in Watch Party chat Women destroy body Relatable baby flamingo is trying very hard to be an adult Obama gets the grand tour of Indonesia's royal palace
1.9243s , 10131.6875 kb
Copyright © 2025 Powered by 【Lena Paul - The Next Morning】,Miracle Information Network