Teddy bear toy may pose privacy threat for parents, children

WASHINGTON - Cyber experts are worried about an internet-connected toy in children's homes. Spiral Toys, the maker of CloudPets, is at the center of a possible data breach as hundreds of thousands of voice recordings, emails and passwords from user accounts may have been exposed, according to a report.

CloudPets are talking stuffed toy animals that look innocent enough, but they are a cyber security threat. Using a smartphone app, you can record a message and have it sent to the toy.

"We are talking about everything from refrigerators to lighting systems to lock systems to alarm systems to dolls and toys and all these sorts of thing," said Paul Paget, the CEO of Pwnie Express, a cybersecurity company.

All of these products Paget is referring to have one thing in common - they can connect to the internet through an app - and with that comes an opportunity for hackers.

Cyber experts recently discovered the accounts linked to these CloudPets were being accessed by multiple people online.

"You put in your email or you put in a password, so they had some security on the device, but evidently they were storing it in a database with a service they were using that failed to actually protect the database and there are crawlers out there on the internet that look for open databases and expose this information," said Paget.

These toy pets are not the only problem. There are reports the My Friend Cayla dolls are also vulnerable to hackers. The doll uses similar Bluetooth technology as CloudPets. In fact, watchdog groups in Germany are telling parents to destroy the My Friend Cayla doll because it can reveal personal information.

"You pair with your car or you pair with a speaker - sometimes you have to add a code which encrypts the connection," said Paget. "But in this case, it is an open connection, which means anyone within range can connect to the teddy bear and interact with the child, which is kind of spooky."

How you interact with the device is not the only thing you should be concerned about. The next time you buy an internet connected device, cyber experts say do your research. If you are not careful, the latest high-tech gadget may end up giving out your personal information.

Paget said the makers of CloudPets have yet to address the possible security breach. If you are looking to buy one of these devices, check the manufacturer by searching its name to see if the company has had any security issues. Look to see what kind of reputation they have.

Otherwise, you may be safer sticking with the stuffed teddy bear that does not talk back.