Energize Lab

Profile narrative

Energize Lab, also known as Energize Lab, is a China-headquartered technology company that develops and operates the Eiliko service, a platform connected to a fleet of interactive robotic toys. The Eiliko system facilitates user conversations, stores detailed user profiles, and processes unencrypted audio recordings and photographs, including images of children. The service appears designed to enable ongoing interaction between users and their devices, creating a continuous data stream between the toys and the company's infrastructure.

The scale of the operation became publicly visible following a security incident disclosed on August 30, 2026, when security researcher Sammy Azdoufal accessed the unprotected Eiliko service and gained fleet-wide access. At that time, the connected fleet numbered approximately 68,000 toys, and the exposed database contained roughly 13 million user conversations. The breadth of accessible data included not only conversation logs but also detailed user profiles, unencrypted audio files, and photographs of children, indicating that the platform handles highly sensitive personal information across a substantial user base.

The incident revealed significant distinguishing attributes regarding the company's security posture and data handling practices. The Eiliko service was operating without adequate access controls, allowing a single researcher to obtain comprehensive access to the entire fleet and all associated user data. The storage of unencrypted audio recordings and children's photographs alongside conversation histories and user profiles suggests a data architecture that aggregates multiple categories of sensitive information without implementing encryption-at-rest or proper authentication barriers. This security failure exposed a consumer robotics platform with a footprint of tens of thousands of active devices to complete data compromise.

Incidents

0 incidents linked to this organisation.