Skip to main content

Connected CloudPets teddy bears blab on owners, leak 2 million voice recordings

Amazon, Walmart, and Target are no longer selling CloudPets

Cloud Pets As Seen On TV Commercial

Remember when the worst thing that could happen to your doll was it losing an eye? How times have changed.

In the latest toy scandal (yes, those are a thing now), a connected teddy bear leaked the voice recordings of more than 2 million children and parents, along with email addresses and password information associated with more than 800,000 accounts. As first reported by Troy Hunt in a blog post published in late February, Spiral Toys, the company behind the CloudPets line of stuffed animals, left a whole lot of user data vulnerable to attack. Now, those toys have been pulled from a number of retailers, including Amazon, Walmart, and Target.

Amazon began taking down CloudPets from its online marketplace after being contacted by Mozilla, which offered research that highlighted the potential dangers of the child’s toy.

“In a world where data leaks are becoming more routine and products like CloudPets still sit on store shelves, I’m increasingly worried about my kids’ privacy and security,” Ashley Boyd, Mozilla’s vice president of advocacy, said in a statement.

When it comes to CloudPets, it looks like that concern is well-placed. A few months ago, Hunt explained the vulnerability, writing in his blog post, “…in CloudPets’ case…data was stored in a MongoDB that was in a publicly facing network segment without any authentication required and had been indexed by Shodan (a popular search engine for finding connected things).” So what does that mean? In essence, customer data could be easily accessed by just about anyone, and accessed it was. Hunt noted that as per data from Shodan, between December 25 and January 8, customer data was looked into many times by many people, including by malicious parties who demanded ransom for the release of some of this data.

Worse still, it would appear that CloudPets was actually warned of this problem, with Hunt noting that a good samaritan had “tried to contact CloudPets three times to warn them about the exposure.” Unfortunately, the email address listed on the company’s support page bounced back, and subsequent attempts at contact went unanswered.

Sadly, Hunt said, this kind of willful ignorance seems to be rather commonplace, particularly in the realm of cybersecurity. “Time and time again, there are extensive delays or no response at all from the very people that should be the most interested in incidents like this,” he wrote. “If you run any sort of online service whatsoever, think about what’s involved in ensuring someone can report this sort of thing to you because this whole story could have had a very different outcome otherwise.”

Updated on June 5: Amazon, Walmart, and Target pulled CloudPets from stores. 

Lulu Chang
Former Digital Trends Contributor
Fascinated by the effects of technology on human interaction, Lulu believes that if her parents can use your new app…
Roborock S8 MaxV Ultra vs. Roborock S8 Pro Ultra: Which is the best robot vacuum?
The Roborock S8 MaxV Ultra placed in its dock.

The Roborock S8 MaxV Ultra and Roborock S8 Pro Ultra share a lot of similarities -- the least of which is their brand name. Along with the capacity to vacuum and mop in a single cleaning cycle, the two robots can automatically empty their dustbins and clean their dirty mops once the cycle is complete. That alone makes them two of the best robot vacuums on the market.

But while there are plenty of similarities between the S8 MaxV Ultra and S8 Pro Ultra, there are a few key differences that could make one better for your home than the other. From pricing and vacuuming power to navigational skills and more, here's a comprehensive look at the Roborock S8 MaxV Ultra and Roborock S8 Pro Ultra.
Pricing and availability

Read more
How to fix a Ring doorbell that won’t chime
Person installing Ring video doorbell

While Ring does make some of the best video doorbells, they aren't immune to issues with their chime. This issue is, after all, at the top of the list when it comes to video doorbell problems. But, if your Ring won't ring what should you do? We break down the procedure to get your Ring video doorbell back in action, with a step-by-step approach to troubleshooting this issue.

Read more
Ring sale: Up to 44% off video doorbells and security cameras
The Ring Video Doorbell 3 installed near a door.

Buying a video doorbell or a security camera are among the easiest ways of improving your home's security, and Ring is one of the most trusted names if you're planning to get either or both of these devices. If you're interested, there's an ongoing Ring sale on Amazon so that you wouldn't have to pay full price. The available Ring deals include standalone security gadgets and bundles, and you can get as much as 44% off their sticker prices, but only if you hurry because there's no telling how much time is remaining on these offers.

What to buy in Amazon's Ring sale
Ring is a mainstay in our lists of the best video doorbells and best home security cameras because of the helpful features that they'll provide, including 24/7 live streaming through the Ring app, two-way audio to talk to visitors outside your front door or family members inside, customizable mobile alerts, and compatibility with smart home devices that are powered by Amazon's Alexa, among many others.

Read more