[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fx0cpO2YMWPd1VyPLxqInCnBzaqy68RY2nx7x639kCvw":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":50,"controls":51},"0a113036-7019-4bc9-997e-a066fbb51e1b","childrens-smartwatch-hijacked-to-track-spy-on-kids","08690ed6-69a4-43f9-8fc4-42e461559cc6","Children's Smartwatch Hijacked to Track, Spy on Kids","Cheap GPS-enabled smartwatches marketed for children were found to contain serious security vulnerabilities rooted in a shared, insecure supply chain — meaning dozens of device models were affected by the same flaws simultaneously. Attackers could exploit these weaknesses to silently track real-time location, capture photos, and eavesdrop on audio, turning a safety device into a surveillance tool against its intended user. The root cause lies in manufacturers prioritizing cost over security, shipping devices with default credentials, unencrypted communications, and no secure development lifecycle. This matters because vulnerable IoT devices targeting children represent both a physical safety risk and a serious privacy violation, often with no viable patch path for consumers. Parents and caregivers are rarely equipped to assess the security posture of these devices before purchase.","**Immediate actions:**\n- Disconnect or cease use of affected smartwatch models until the manufacturer issues a verified security patch.\n- Change any default PINs, passwords, or account credentials associated with the device and its companion app immediately.\n\n**Consumer & procurement safeguards:**\n- Research devices using third-party security ratings or reports (e.g., Mozilla's *Privacy Not Included* guide) before purchasing IoT products for children.\n- Prefer devices from manufacturers who have a published vulnerability disclosure policy and a track record of issuing security updates.\n- Avoid purchasing IoT devices from unverified supply chains or white-label products with no clear manufacturer accountability.\n\n**Long-term improvements:**\n- Advocate for and comply with IoT security regulations (e.g., UK PSTI Act, EU Cyber Resilience Act) that mandate minimum security standards for connected devices.\n- Isolate IoT and smart devices on a dedicated, firewalled network segment separate from primary home or corporate networks.\n- Establish a periodic review process to audit all connected devices in use and retire those that no longer receive security updates.",[12,13,14,15,16,17,18,19,20,21,22],"CIS Control 1 – Inventory and Control of Enterprise Assets","CIS Control 4 – Secure Configuration of Enterprise Assets and Software","CIS Control 16 – Application Software Security","NIST SP 800-213 – IoT Device Cybersecurity Guidance","NIST IR 8259 – Foundational Cybersecurity Activities for IoT Device Manufacturers","NIST CSF PR.SC-1 – Supply Chain Risk Management","GDPR Article 25 – Data Protection by Design and by Default","GDPR Article 5(1)(f) – Integrity and Confidentiality","EU Cyber Resilience Act – Essential Cybersecurity Requirements for Connected Products","ETSI EN 303 645 – Cybersecurity for Consumer IoT","NIST SP 800-171 – Protecting Controlled Unclassified Information",{},"published","2026-08-06T22:20:24.686891+00:00","2026-08-06T22:20:24.417+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fwww.wired.com\u002Fstory\u002Fhackers-stalked-me-by-hijacking-a-smartwatch-for-kids\u002F","hackers-stalked-me-by-hijacking-a-smartwatch-for-kids-691f0d","Hackers Stalked Me by Hijacking a Smartwatch for Kids",[32,38,44],{"id":33,"name":34,"slug":35,"description":36,"color":37},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":39,"name":40,"slug":41,"description":42,"color":43},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":45,"name":46,"slug":47,"description":48,"color":49},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[52,55,59],{"slug":35,"name":53,"problem":54},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":56,"name":57,"problem":58},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",{"slug":60,"name":61,"problem":62},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control."]