# Eiliko robot toy stores chats on Chinese servers, hack exposes data

> A researcher showed that the popular Eiliko digital pet sends full conversation transcripts to China, where they can be accessed and altered.

Oossa · 2026-10-15 · https://oossa.com/en/eiliko-robot-toy-stores-chats-on-chinese-servers-hack-exposes-data

The Eiliko robot, sold as a cute “digital pet,” records everything you say and uploads it to servers operated in China. A security researcher was able to pull a complete transcript of a conversation held on August 30, 2026, and later accessed a database containing millions of other users’ talks. The toy’s app has no encryption for the stored data, and the company, Energize Lab, has not responded to requests for comment.

## What the breach revealed

The researcher, who goes by Sammy Azdoufal, found a searchable, full‑text database that lists more than 13 million conversation snippets from roughly 68 000 active Eiliko units. The United States holds the largest share of profiles, with over 31 000 belonging to children. The database also stores email addresses, IP locations, short audio clips, and even unencrypted photos of some users. Passwords for admin accounts were simple enough to be on common‑password lists.

## Why it matters for families

If a hacker gains access, they can read private talks, build detailed personal profiles, and even hijack the toy’s language model to make it say false or harmful things. That could expose children to inappropriate content or be used for phishing scams. The lack of a response from Energize Lab leaves owners without a clear way to protect or delete their data.

## The facts

- The researcher captured a full transcript of a conversation held on August 30, 2026.
- Energize Lab’s servers store over 13 million conversation snippets from an estimated 68 000 Eiliko units.
- More than 31 000 of the stored profiles belong to children in the United States.
- Audio recordings and photos are kept at public web addresses without encryption.
- Admin passwords were found on common‑password lists, and the company gave only an automated reply to inquiries.

## Why it matters

Parents who let children play with Eiliko should know their spoken data is being saved on insecure servers overseas. A breach could let strangers read private conversations or alter the toy’s responses, creating safety and privacy risks for kids.

## Sources & references

1. [Your secrets aren’t safe with this cute robot toy — they’re on Chinese servers ready to be hacked](https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab) – The Verge, 2026-10-15

Last updated: 2026-10-15