Stuffed 'CloudPets' removed from sale over cybersecurity concerns

Posted: Updated:
PHOENIX (3TV/CBS 5) -

Some of the nation’s largest retailers, including Amazon, Walmart and eBay, stopped selling a stuffed children’s toy this week because of concerns the devices could be easily hacked.

The cybersecurity issues surrounding CloudPets were first exposed in February 2017. Security researchers demonstrated the Bluetooth-enabled devices could be hijacked and turned into a listening device.

They also showed the CloudPets database hosting 800,000 accounts had been hacked and released online, exposing emails, passwords and voice recordings of children and adults.

“I was unaware, which is really scary for me,” said Phoenix mom Alysa Marks. Marks bought a CloudPet for her daughter in December 2016.

“Now I have to go back and make sure my information is protected,” she said.

Retailers began removing the products after Mozilla, the non-profit company behind Firefox, commissioned an audit that revealed the vulnerabilities still hadn’t been resolved.

 “We are in the process of removing these items as they are in violation of our policy,” an eBay spokesperson said.

The representative did not respond to a question about why the company didn’t remove the listings sooner, when the issues were exposed 15 months ago.

“It's kind of concerning to me in a large way that something as big and open and publicized as this took a large, large group like Mozilla that owns Firefox to basically hound them with as much pressure as they could,” said John Sabo of Scottsdale-based FreeHackReport.com.

Sabo said the hacked usernames, passwords, and voice recordings are still available online on a server owned by Amazon.

The app needed to operate CloudPets has been removed from both the Apple and Android marketplaces.

However, there were a few dozen used CloudPets for sale in the Valley on apps like OfferUp and Facebook as of this week.

Click/tap here to download the free azfamily mobile app.

Copyright 2018 KPHO/KTVK (KPHO Broadcasting Corporation). All rights reserved.


Derek StaahlDerek Staahl is an Emmy Award-winning reporter and fill-in anchor who loves covering stories that matter most to Arizona families.

Click to learn more about Derek.

Derek Staahl

This once-uncompromising "California guy" got his first taste of Arizona in 2015 while covering spring training baseball for his former station. The trip spanned just three days, but Derek quickly decided Phoenix should be his next address. He joined CBS 5 and 3TV four months later, in August 2015. Before packing his bags for the Valley of the Sun, Derek spent nearly four years at XETV in San Diego, where he was promoted to Weekend Anchor and Investigative Reporter. Derek chaired the Saturday and Sunday 10 p.m. newscasts, which regularly earned the station's highest ratings for a news program each week. Derek’s investigative reporting efforts into the Mayor Bob Filner scandal in 2013 sparked a "governance crisis" for the city of San Diego and was profiled by the region’s top newspaper. Derek broke into the news business at WKOW-TV in Madison, WI. He wrote, shot, edited, and presented stories during the week, and produced newscasts on the weekends. By the end of his stint, he was promoted to part-time anchor on WKOW’s sister station, WMSN. Derek was born in Los Angeles and was named the “Undergraduate Broadcast Journalism Student of the Year” in his graduating class at USC. He also played quads in the school’s famous drumline. When not reporting the news, Derek enjoys playing drumset, sand volleyball, and baseball.

Hide bio

  • Featured VideoMore>>

  • Apache Junction teen left in ICU after fatal I-40 wrong-way crash

    Apache Junction teen left in ICU after fatal I-40 wrong-way crash

    Tuesday, June 19 2018 10:19 AM EDT2018-06-19 14:19:22 GMT
    When her parents got there, they couldn’t believe how bad of shape 16-year-old Meckensy Toro was in. (Source: 3TV/CBS 5)When her parents got there, they couldn’t believe how bad of shape 16-year-old Meckensy Toro was in. (Source: 3TV/CBS 5)

    Last week, 16-year-old Meckensy Toro celebrated her birthday, and this week, she's celebrating being alive in the ICU, because this past Saturday was almost her last.

    More >

    Last week, 16-year-old Meckensy Toro celebrated her birthday, and this week, she's celebrating being alive in the ICU, because this past Saturday was almost her last.

    More >
  • Shipping mix-up means 2 special children get needed wheelchairs

    Shipping mix-up means 2 special children get needed wheelchairs

    Tuesday, June 19 2018 9:58 AM EDT2018-06-19 13:58:56 GMT
    Parker and Jacqueline now both have wheelchairs to get around thanks to a shipping mix-up. (Source: 3TV/CBS 5)Parker and Jacqueline now both have wheelchairs to get around thanks to a shipping mix-up. (Source: 3TV/CBS 5)
    Parker and Jacqueline now both have wheelchairs to get around thanks to a shipping mix-up. (Source: 3TV/CBS 5)Parker and Jacqueline now both have wheelchairs to get around thanks to a shipping mix-up. (Source: 3TV/CBS 5)

    A missing wheelchair is returned, and now a second child has a chair, too, thanks to a shipping mix-up.

    More >

    A missing wheelchair is returned, and now a second child has a chair, too, thanks to a shipping mix-up.

    More >
  • Tax refund missing due to 'one digit off'

    Tax refund missing due to 'one digit off'

    Tuesday, June 19 2018 9:58 AM EDT2018-06-19 13:58:44 GMT
    Cristina Allen said she messed up putting in her bank account when filing her taxes and now she doesn't have her refund. (Source: 3TV/CBS 5)Cristina Allen said she messed up putting in her bank account when filing her taxes and now she doesn't have her refund. (Source: 3TV/CBS 5)
    Cristina Allen said she messed up putting in her bank account when filing her taxes and now she doesn't have her refund. (Source: 3TV/CBS 5)Cristina Allen said she messed up putting in her bank account when filing her taxes and now she doesn't have her refund. (Source: 3TV/CBS 5)

    An Arizona taxpayer typed in the wrong bank account number and didn't receive her tax refund.

    More >

    An Arizona taxpayer typed in the wrong bank account number and didn't receive her tax refund.

    More >