Eiliko Robot Exposed 13 Million Private Conversations

A researcher gained access to about 13 million conversations stored by the maker of Eiliko, a small AI companion robot sold through Amazon. The exposed information included profiles of children, making this a serious privacy concern for families that have allowed the toy to connect to Wi-Fi.

What happened

According to The Verge, security researcher Sammy Azdoufal found that Energize Lab’s online service was not properly protected. He reportedly could search stored conversations and access what appeared to be the company’s active worldwide fleet of 68,000 robot toys.

The service contained roughly 13 million conversations involving tens of thousands of people. The Verge reported that the system analyzed those conversations to create detailed profiles containing information such as a person’s name, age, birthday, job, family, friends, pets and personality traits.

Those records were stored alongside email addresses, IP addresses and searchable conversation transcripts, according to the report. Some short audio recordings were also available. Photos associated with larger Eiliko-related robots that include cameras were reportedly stored without encryption at public web addresses.

This information could be valuable to scammers because it may reveal family relationships, personal worries and other details that make a fake message or call more believable.

The provided source does not say that Energize Lab has secured the service, deleted the exposed records or released a software update. It also does not disclose a complete list of affected models.

Who is affected

Families that connected an Eiliko robot or a related Energize Lab device to Wi-Fi should treat conversations with the device as potentially exposed. The Verge reported that the United States was the product’s largest market in the accessed data and that more than 31,000 profiles appeared to belong to children.

Parents should also consider whether a child shared names, birthdays, school details, family information or private concerns with the toy. The report indicates that ordinary voice conversations could be turned into lasting, searchable profiles.

What to do now

1. Disconnect the robot immediately. Turn it off or unplug it. In your router’s app or web dashboard, open the connected-device list, find the Eiliko or Energize Lab device, and pause or block its internet access.

2. Remove its Wi-Fi access. If the companion app offers a network or device settings page, use it to forget the saved network. If that option is unavailable, change the Wi-Fi password and reconnect only devices you trust.

3. Stop sharing personal information with the toy. Tell children not to discuss names, birthdays, schools, addresses, health concerns, passwords or family routines with any internet-connected AI companion.

4. Review the associated account. Open the Eiliko app and look under Account, Privacy, Data or Security for controls to delete conversation history, recordings, profiles and the account itself. The source does not confirm which deletion controls are available.

5. Watch for personalized scams. Be cautious if calls, texts or emails mention private details that were discussed near the robot. Independently contact relatives or organizations using a known phone number before acting.

How to protect your home network

Putting smart toys and other connected gadgets on a separate network can limit their access to computers and phones in your home, although it cannot prevent a manufacturer’s cloud service from exposing uploaded data. See CyberSec24’s guide to setting up guest Wi-Fi for practical steps.