Chinese-made smart coffee machines might be spying on you, say researchers

American researchers have found evidence that smart coffee machines manufactured in China collect information like product information, payment data and customer behavior and store it in China, thus exposed to its communist government.

Researcher Christopher Balding of New Kite Data Labs, who published a report on their findings, said the data collection was part of a broader problem with Internet of Things (IoT) devices, like robotic vacuums and smart thermostats connected to the internet, which can have low security and unclear data policies.

“China is really collecting data on really just anything and everything,” Balding told The Washington Times.

“As a manufacturing hub of the world, they can put this capability in all kinds of devices that go out all over the world.”

New Kite Data Labs analyzed part of a database of a Chinese coffee maker company, which included device name, type of coffee made or sold, payment information, and customer information like time and location, according to the report.  

Balding told The Washington Times that the company was Kalerm, based in Jiangsu, China.

The report noted that all the reviewed data came from China-based machines, the company also sells models widely throughout the United States, Europe, and other outside markets through third-party distributors.

"While we cannot say this company is collecting data on non-Chinese users, all evidence indicates their machines can and do collect data on users outside of mainland China and store the data in China. The data is collected at the point of operation from software embedded in the coffee maker,” the report said.

"Most countries of any significant size probably have interest in devices like this - make zero mistake about that. I think the thing that is unique about China is the breadth and depth of their data-collection efforts.”

The case underscores how many consumers are unaware of where data collected about them is transmitted and stored, which “can inadvertently reveal identifiable and potentially sensitive information that can be risky in the hands of an adversarial state,” according to the report.