Sphero, a U.S.-based educational robotics company that produces programmable robots and STEM kits used in schools, suffered a data breach disclosed in September 2023. A hacker exploited security vulnerabilities including a flaw in the company's GraphQL API to extract more than one million rows of user data, which was subsequently posted on a hacking forum. The breach was first publicly reported by SafetyDetectives in October 2023.\n\nThe dataset contained approximately 832,000 unique email addresses paired with names, usernames, dates of birth, and geographic locations. Affected users include educators and students across schools that used Sphero programs, with student data accounting for a significant share of the records. Sphero declined to comment publicly on the incident when contacted by researchers and journalists, and reporting from Hong Kong indicated that the territory's Office of the Privacy Commissioner for Personal Data had not been notified.\n\nFor affected individuals, the practical risk is concentrated in identity-fraud and phishing scenarios with a school-themed pretext. The combination of name, date of birth, and geographic location is a strong base for credential-stuffing attacks against student or teacher accounts on other education platforms, and for impersonation messages purporting to be from a school or vendor. Because student data is involved, the exposure has unusually long downstream relevance, since identity fraud built on a child's date of birth can remain invisible until the affected individual reaches adulthood and applies for credit, college, or employment. Parents of students who used Sphero products should monitor for unusual account activity and treat any unsolicited contact referencing the child's school or coding activities with caution.

Educational technology providers collect customer accounts, order data, device registrations, classroom usage information, and in some cases student or educator-linked activity tied to robotics and STEM products.

Sphero has continued to operate as an educational robotics company in the years since the 2023 incident. The company never publicly commented on the breach despite being approached by researchers and journalists, and Hong Kong's Office of the Privacy Commissioner for Personal Data was not notified at the time. The 2023 dataset was indexed by Have I Been Pwned and added to public breach-tracking services in October 2023. Sphero has not been publicly tied to a further breach disclosure since then. The broader educational technology sector has continued to draw scrutiny over data-handling practices for student accounts.