Loading story…
Kohler's new smart toilet product, the Dekoda, has come under scrutiny after security researchers and engineers revealed that its camera system does not provide true end-to-end encryption as advertised. While the company claims that user data is protected with end-to-end encryption and stored securely, technical analysis and direct communication with Kohler confirmed that the data is decrypted and processed on Kohler's own systems, meaning the company itself can access sensitive footage and health data. This revelation has raised significant privacy concerns, especially given the intimate nature of the data being collected and the misleading use of security terminology in marketing materials.
The controversy has sparked public backlash and renewed debate about the privacy implications of internet-connected health devices, particularly those that collect highly sensitive personal information. Experts warn that the presence of cameras in such devices, combined with ambiguous or misleading claims about encryption, could expose users to privacy violations and potential misuse of their data. The incident highlights the need for greater transparency and accuracy in how companies describe their security practices, as well as the importance of robust privacy protections for emerging health technologies.
See the reporting duties and controls this puts on the clock.
2 events from the most recent confirmed update back to the earliest known activity.
A security researcher determined that Dekoda does not provide true end-to-end encryption because Kohler can decrypt and access user data once it reaches the company's servers. The finding raised concerns that sensitive health-related camera data is accessible to the company contrary to typical expectations for E2EE.
Kohler introduced the Dekoda device, a smart toilet attachment that uses optical sensors and machine learning to analyze toilet bowl contents and provide health insights. The product was marketed with privacy claims including end-to-end encryption.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Consumer CCTV and smart camera systems, widely adopted for home security, present significant privacy and security risks. In several documented cases, criminals have accessed CCTV footage by exploiting weak or stolen passwords, sometimes purchased cheaply from public databases, allowing them to obtain sensitive video recordings before victims are even aware of a crime. These incidents highlight that while cameras can deter theft and provide evidence, they also create new vulnerabilities if not properly secured, raising concerns about who truly controls access to surveillance data. Beyond the risk to device owners, smart cameras and doorbells routinely capture footage of bystanders—neighbors, visitors, and passersby—without their knowledge or consent. A recent study found that most major vendors of these devices do not adequately address bystander privacy in their policies, often placing the responsibility on device owners rather than taking proactive steps to protect non-users. Legal frameworks like GDPR and CCPA offer limited guidance for recordings made on private property, leaving significant gaps in privacy protection for individuals inadvertently caught on camera.
Jul 12, 2026
Voice assistants and other smart home devices are generating detailed records that can later be accessed by companies or sought by law enforcement, raising concerns that everyday household technology may become a source of criminal evidence. Reporting highlighted that devices such as Amazon Alexa continuously collect behavioral, audio, and usage data, with wake-word systems capable of false activations that may cause unintended recordings to be uploaded for cloud processing and retention. The coverage pointed to U.S. criminal investigations in Arkansas, Florida, and New Hampshire in which Amazon Echo data was sought or used, underscoring how cloud-stored smart home records can become subpoenaable evidence. It also warned that smart TVs, robot vacuums, smart locks, Fitbits, and even connected water meters can create searchable logs of daily life, and urged users to reduce exposure by inventorying connected devices, limiting unnecessary internet connectivity, understanding whether devices are truly powered off, and keeping at least one room free of smart technology.
Aug 11, 2026
Smart eyewear devices such as Meta Ray Ban glasses, equipped with microphones, cameras, and AI connectivity, present significant privacy and data security risks when used in hospital settings. These devices can inconspicuously record or livestream protected health information (PHI), including patient images and conversations, often without the knowledge or consent of those being recorded. The presence of a small LED indicator is insufficient as a safeguard, especially since third-party products exist to obscure the light, making unauthorized recording even harder to detect. Healthcare organizations face challenges as these are often unmanaged devices brought in by patients or staff, bypassing institutional controls and oversight. The direct connectivity of these glasses to social media platforms like Facebook and Instagram increases the risk of inadvertent or malicious disclosure of sensitive information, potentially violating HIPAA/HITECH regulations. The inconspicuous nature of smart glasses differentiates them from more obvious recording devices like smartphones, heightening the risk of unnoticed privacy breaches in clinical environments.
Jun 29, 2026