The Eiliko robot, sold as a cute “digital pet,” records everything you say and uploads it to servers operated in China. A security researcher was able to pull a complete transcript of a conversation held on August 30, 2026, and later accessed a database containing millions of other users’ talks. The toy’s app has no encryption for the stored data, and the company, Energize Lab, has not responded to requests for comment.
What the breach revealed
The researcher, who goes by Sammy Azdoufal, found a searchable, full‑text database that lists more than 13 million conversation snippets from roughly 68 000 active Eiliko units. The United States holds the largest share of profiles, with over 31 000 belonging to children. The database also stores email addresses, IP locations, short audio clips, and even unencrypted photos of some users. Passwords for admin accounts were simple enough to be on common‑password lists.
Why it matters for families
If a hacker gains access, they can read private talks, build detailed personal profiles, and even hijack the toy’s language model to make it say false or harmful things. That could expose children to inappropriate content or be used for phishing scams. The lack of a response from Energize Lab leaves owners without a clear way to protect or delete their data.
Why it matters
Parents who let children play with Eiliko should know their spoken data is being saved on insecure servers overseas. A breach could let strangers read private conversations or alter the toy’s responses, creating safety and privacy risks for kids.
