Sphero 2023 Data Breach
Company · Robotics and educational technology · Consumer and STEM products provider · USA
Sphero Educational Robotics Company Breach (2023): 832K User Records Including DOB & Location Exposed
Educational robotics company.
Confirmed · ObscureIQ Intelligence
Breach Risk Index i
44/100
Lower riskHigher risk
Moderate: notable exposure with meaningful misuse potential.
Data Sensitivity i
RestrictedBeing associated with this breach can itself be harmful. Disclosure is limited and presence is not confirmed to unverified parties.
832KRecords
2023Year
The Breach Risk Index (BRI) is a proprietary 0–100 score rating how dangerous a breach is right now, based on how recently the data has been circulating on the dark web and how valuable it is to attackers.
Crucial data exposed
MinorsChildren / minors
Breach Summary
Sphero, a U.S.-based educational robotics company that produces programmable robots and STEM kits used in schools, suffered a data breach disclosed in September 2023. A hacker exploited security vulnerabilities including a flaw in the company's GraphQL API to extract more than one million rows of user data, which was subsequently posted on a hacking forum. The breach was first publicly reported by SafetyDetectives in October 2023.\n\nThe dataset contained approximately 832,000 unique email addresses paired with names, usernames, dates of birth, and geographic locations. Affected users include educators and students across schools that used Sphero programs, with student data accounting for a significant share of the records. Sphero declined to comment publicly on the incident when contacted by researchers and journalists, and reporting from Hong Kong indicated that the territory's Office of the Privacy Commissioner for Personal Data had not been notified.\n\nFor affected individuals, the practical risk is concentrated in identity-fraud and phishing scenarios with a school-themed pretext. The combination of name, date of birth, and geographic location is a strong base for credential-stuffing attacks against student or teacher accounts on other education platforms, and for impersonation messages purporting to be from a school or vendor. Because student data is involved, the exposure has unusually long downstream relevance, since identity fraud built on a child's date of birth can remain invisible until the affected individual reaches adulthood and applies for credit, college, or employment. Parents of students who used Sphero products should monitor for unusual account activity and treat any unsolicited contact referencing the child's school or coding activities with caution.
Full threat analysis, exploitation vectors, and principal guidance below.
10 additional sections · verified field analysis · defensive doctrine
Querying breach corpus…
Cross-referencing exposed field types…
Resolving threat-actor attribution…
Compiling principal risk advisory…
832K records analyzed
About Sphero
Sphero is a U.S.-based educational technology company headquartered in Boulder, Colorado, with operations including a Hong Kong office. The company designs and sells programmable robots and STEM education kits used in schools, classrooms, and home learning environments. Its flagship product line includes ball-shaped robots controlled through programming apps, alongside coding kits and curriculum materials. Sphero's customer base is heavily institutional, with schools and educators making up the bulk of deployments, while individual user accounts are held by both teachers and students learning to code. The company maintains the centralized account and learning-progress systems typical of an education-software platform.
Why They Hold Your Data
Educational technology providers collect customer accounts, order data, device registrations, classroom usage information, and in some cases student or educator-linked activity tied to robotics and STEM products.
Recent Developments
Sphero has continued to operate as an educational robotics company in the years since the 2023 incident. The company never publicly commented on the breach despite being approached by researchers and journalists, and Hong Kong's Office of the Privacy Commissioner for Personal Data was not notified at the time. The 2023 dataset was indexed by Have I Been Pwned and added to public breach-tracking services in October 2023. Sphero has not been publicly tied to a further breach disclosure since then. The broader educational technology sector has continued to draw scrutiny over data-handling practices for student accounts.
Data Points Exposed
5 verified field types
Date of Birth High
Email Address
Full Name
Geographic location
Username
Breach Impact
The institutional impact on Sphero from the 2023 incident is unusual because the company's silence dominated the response. There has been no public regulatory action, settlement, or large-scale customer notification campaign associated with the breach. The reputational cost has been measurable but diffuse, given Sphero's institutional customer base of schools and education resellers, where data-handling practices can become a procurement filter. The exposure of student dates of birth and geographic locations carries unusually high downstream risk for minors, since identity-fraud risk on a child's profile can persist undetected until adulthood. Privacy regulators in jurisdictions where Sphero operates have not announced public action.
Exploitation & Downstream Threats
• Identity verification bypass using name + date of birth combination | • Targeted phishing campaigns using exposed email addresses | • Doxxing risk from physical address exposure
Principal Risk Advisory
What this means for a principal
An education-sector breach: student, staff and identity records support identity theft and targeted phishing. For a high-profile principal the main risk is credible impersonation and enrichment of existing exposure.
What You Should Do
- Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.
How ObscureIQ Can Help
- Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
- Exposure mapping: cross-reference the exposed identifiers against broker-available data to size and prioritize the principal's wider footprint.
- ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).
Protect Yourself
Protect Yourself: Limited Disclosure
Check Exposure: Verification Required
Because this breach involves data about minors, we do not confirm whether any individual appears in it to unverified parties. A verified parent, guardian, or the individual can privately check exposure.
We confirm exposure only to the affected individual or their verified parent or guardian.
Get Free Breach Alerts
Be the first to know when new breaches are disclosed. Free forever — confirm your email with a 6-digit code.
High-Risk? Get an Exposure Audit
Executives, public figures, and high-visibility operators can receive tailored exposure intelligence and hardening guidance.
Request Consultation