I recently ran across an article on arstechnica.com which outlines a recently discovered hack for teddy bears. Apparently, Spiral Toys, the manufacturer of Cloud Pets Stuffed Animals, implemented a security breach in their teddy bears which allowed for over 2 million voice recordings being leaked, as well as the e-mail addresses and passwords of over 800,000 accounts.

Does anyone know anything more about this attack? Can these teddy bears be secured with a firmware update or something? How can a Cloud Pets Teddy Bear be kept from being hacked?

1 Answer 1


In general: a fairly common denominator in large scale breaches is the fact that it are not the individual IoT devices (Teddy bears, toys, sensors and what more) that get hacked, but instead the central servers get compromised.

Patches or security updates to the IoT device itself won't resolve that...

Since the individual IoT devices have only limited compute capacity they uplink over the internet to large scale servers and datacenters operated by the manufacturer for their number crunching.
There data from your devices/toys gets sent, associated with your account and profile, and subsequently stored and processed. Often the algorithms processing your data improve when they get to work with more (aggregated) data and neither the stored original data nor such aggregated data will ever be deleted.

Often access to that data proves to be secured insufficiently and when that security gets compromised it is not the data from a single device or user that gets leaked, but from many, if not all customers.

That is the case as well in the article you linked to.

After such large incidents and data breaches you, as an end-user, might get to see updates in the app/firmware/account homepage allowing you to opt-out of such data collection, but typically that comes with a (significant) reduction in functionality, if they device could actually still operate at all without such central data processing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.