Keep Your Kids Away From Connected Toys

How dangerous is a teddy bear or a doll? In the Internet of Things era, it's not an idle question but one for parents and regulators to ponder seriously.

On Monday, Troy Hunt, the cybersecurity expert who maintains the "Have I been pwned?" database of major breaches affecting the clients of internet businesses, revealed a problem with CloudPets, a series of cuddly toys made by a U.S. company called Spiral Toys. The toys allow parents to talk with their kids remotely. The conversations were recorded and stored -- along with users' encrypted passwords -- on an unprotected server that belonged to a Romanian company called mReady. The passwords were easy to break. Hunt listened to some of the messages -- sweet nothings kids want to say to their parents. Any malicious actor could have figured out how to communicate with the kids. Apparently, the exposed database was located numerous times using a search engine that finds connected devices, and attempts were made to hold Spiral Toys for ransom.