Archive — US — techcrunch
Sex toy maker Lovense caught leaking users’ email addresses and exposingaccounts to takeovers
Lovense, a major sex toy maker, faces scrutiny for failing to fix security flaws exposing users' email addresses and enabling account takeovers. A researcher revealed details of the vulnerabilities after Lovense requested 14 months for a fix. The flaws potentially jeopardize the privacy of over 20 million users, including cam models, raising serious concerns about data security in internet-connected devices.
Key points
- Lovense exposed users' email addresses and allowed unauthorized account access due to security flaws.
- The researcher BobDaHacker disclosed the flaws to Lovense on March 26 after they were previously reported.
- Lovense claimed it would take 14 months to fix the flaws, arguing against a quicker resolution that might inconvenience legacy users.
- The first flaw enabled users to see others' email addresses through network analysis, a risk particularly for cam models.
- The second flaw permitted account takeover by generating authentication tokens with just an email address.
- BobDaHacker received $3,000 via HackerOne for reporting the bugs, but went public due to slow response and ineffective fixes from Lovense.
Why it matters
- This incident underscores ongoing concerns about the security of IoT devices, particularly in sensitive areas like personal privacy.
- The growing market for connected sex toys, highlighted by Lovense's integration with ChatGPT, reflects broader trends in tech merging with intimate products.
- It aligns with increasing discussions around data privacy regulations that may arise in response to similar breaches in 2025.
The Lovense security breach highlights significant vulnerabilities in IoT devices, stressing the need for urgent and effective fixes to protect users' privacy, particularly those in sensitive professions like cam modeling.