The CloudPets range of soft toys let children record message and have them play back, as if spoken by the toy. These could be messages recorded by the children themselves, or by their parents via a smartphone app. It was then found in early 2017 that every recording was stored online, and that these recordings were unprotected.

It was also found by security researcher Troy Hunt how the recordings had been accessed multiple times by unauthorized parties, and the data had even been held for ransom before Spiral Toys addressed the issue. Context Information Security, another specialist firm, found hackers could remotely instruct the toy record whenever they wanted, turning it into a spying device.

This is another example of a manufacturer producing a 'smart' and connected product, without properly securing the data it collects and fully understanding the consequences. Parents are urged to pay close attention to how any connected toys work, keep their software up-to-date, and use strong passwords at every step. But, ultimately they must ask themselves if such a product - capable of recording and connected to the internet - is really suitable for their children at all.