Security researcher Sammy Azdoufal successfully breached the network of Eiliko robots, manufactured by Energize Lab. The vulnerability affected approximately 68,000 units, which represents the entire fleet of these devices produced by the company. The breach granted unauthorized access to 13 million user conversations.
The system maintained detailed user profiles, including names, ages, birth dates, occupations, and marital status. These records were stored alongside email addresses, IP addresses, and search databases. The company also collected and stored photographs, including images of children, who accounted for 31,000 of the registered profiles.
Azdoufal demonstrated the ability to remotely manipulate robot memory and behavior. In a controlled test, he forced a device to contact its owner with false information regarding a family tragedy. The researcher also noted that the system compiled psychological assessments, such as personality traits and emotional states, for individual users.
Despite repeated attempts by The Verge and the researcher to contact Energize Lab over the course of more than a month, the company has provided no response. Communication efforts involved multiple email addresses linked to the founder and various departments, as well as outreach through professional networking platforms.
