Hackers Stalked Me by Hijacking a Smartwatch for Kids

Security researchers tracked and eavesdropped on a WIRED reporter by exploiting vulnerabilities in a pink plastic smartwatch marketed for kids. The incident, reported by Wired under the title Hackers Stalked Me by Hijacking a Smartwatch for Kids, shows that a device sold as a parental safety tool can be turned into a live location and listening channel against the wearer.

The attack did not require exotic hardware. Researchers abused weaknesses in the smartwatch itself and in the broader stack that makes GPS-enabled kids gadgets work: the device, its companion apps, and the cloud services that sync location and audio. Once that chain is compromised, tracking and eavesdropping become product features in reverse—available to whoever can reach the insecure path rather than only to a parent.

For engineers and builders, the story is a concrete failure of threat modeling on consumer IoT. A kids smartwatch concentrates identity, location, and often voice on a small, always-on endpoint that lives on a child and phones home continuously. If authentication, pairing, firmware update paths, or backend access controls are weak, the same APIs that deliver “where is my kid” become the APIs that deliver “where is the reporter.” Shipping GPS and mic without treating the full supply chain as a security boundary is not a niche risk; it is the product.

That smartwatch is presented as one piece of a larger, deeply insecure supply chain of GPS-enabled gadgets. Similar devices—trackers, wearables, and low-cost connected kids products—often share vendors, modules, white-label firmware, and app backends. Competition on price and feature checklists (location, SOS, listen-in) outruns investment in secure design, so one pink plastic watch is less an outlier than a visible instance of a market pattern.

The practical takeaway for teams building or integrating these products is to treat location and audio as high-risk sensors from day one: lock down pairing and account takeover, assume the companion app and cloud are in scope, and verify the whole path end to end rather than trusting the badge “for kids” as a safety signal. Watch next for whether retailers, platforms, and regulators force minimum security bars on GPS kids gadgets—or whether the same supply chain keeps shipping trackable, eavesdroppable hardware under a parental-control label.