TAMPA, FLA. (WSVN) - Parents may need to keep a closer eye on their kids’ toys, as millions of personal recordings made on smart toys have recently been leaked online, FBI officials said.
According to Fox 13, FBI spokesperson Gerrett H. Croon warned parents that internet-connected toys, like the Cloud Pet, are a cyber threat.
“If you accept that toy into your home, you accept the responsibilities that come with it. So, beware,” Croon said.
Hackers may be able to collect private information, like the child’s school, name and activities and, according to the FBI’s Internet Crime Complaint Center, toys with sensors, microphones, cameras and GPS options could put kids at risk.
“Your children may be speaking to the toys, or there could be background noise,” Croon told Fox 13. “Those audio recordings or video recordings are sent to a database somewhere in the sky, which could be hacked by someone, unwittingly releasing information that’s personal to you.”
CNN reports that, back in February, 2.2 million voice recordings from CloudPets toys were hacked by criminals, who accessed the data through an insecure database.
Along with encouraging parents to inspect the toys themselves, the FBI recommends:
- Only connect and use toys in environments with trusted and secured wi-fi Internet access
- Research the toy’s Internet and device connection security measures
- Use authentication when pairing the device with Bluetooth (via PIN code or password)
- Use encryption when transmitting data from the toy to the wi-fi access point and to the server or cloud
- Research if your toys can receive firmware and/or software updates and security patches
- Ensure your toys are running on the most updated versions and any available patches are implemented
- Research where user data is stored – with the company, third party services, or both – and whether any publicly available reporting exists on their reputation and posture for cyber security
- Carefully read disclosures and privacy policies (from company and any third parties)
- Provide only what is minimally required when inputting information for user accounts
If you believe a toy has been compromised, visit www.IC3.gov.
Copyright 2025 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten or redistributed.