A smartwatch designed to help parents keep tabs on their children turned out to be surprisingly easy to hijack. In a new demonstration, security researchers showed how hackers could secretly monitor someone wearing a GPS-enabled kids’ smartwatch.

They can take photos, listen through its microphone, and even track location without the wearer noticing. These findings, reported by Wired, highlight a much larger problem that goes well beyond a single gadget.

One smartwatch revealed a much bigger security problem

Security researchers Vangelis Stykas and Felipe Solferini used a $30 kids’ smartwatch sold online and found they could quietly follow its wearer throughout the day. Even when the GPS signal was glitchy, the watch continued transmitting nearby Wi-Fi information, allowing the researchers to pinpoint the wearer’s location.

They also remotely activated the camera to capture photos and listened through the built-in microphone, all without any visible warning on the device. The watch runs on SETracker, a platform built by Shenzhen manufacturer YiQingTeng, which had an authentication flaw that let anyone send commands to any connected device.

What makes the discovery more concerning is that the smartwatch was not unique. It also echoes a pattern seen in other family-facing connected devices, where outsiders gained silent access without the family ever knowing. According to the researchers, dozens of smartwatch brands rely on the same underlying software platforms and backend services.

How does this affect millions of other kids?

The researchers found vulnerabilities that could let attackers access locations, intercept messages, replace emergency contacts, record audio, and capture photos or videos on supported devices. These issues were privately reported by the researchers months ago. While one company appeared to fix some flaws shortly before their public presentation, others had not responded or remained vulnerable.

After studying more than 70 GPS-enabled devices, they concluded that millions of smartwatches and vehicle trackers are built on just a handful of shared supply chains. That means one security flaw can affect products sold under many different brand names. So parents in two different countries could each buy a differently branded watch and still send their child’s location to the same vulnerable server, without ever knowing it.