How hackers can breach smartwatches to steal data

Smartwatches, which many people use to track their health and physical activity, can become convenient targets for cybercriminals. Hackers are capable of gaining access to sensitive user data and even using it for blackmail, as Dmitry Galov, head of Kaspersky GReAT, warned in an interview with RIA Novosti.

The Main Target Is Not the Device but the Data

According to the expert, technically hacking the smartwatch itself is possible, but in practice attackers more often target not the gadget, but the cloud services and accounts connected to it.

Dmitry Galov explained that attackers look for users with improperly configured privacy settings who openly share their geolocation and other confidential information.

Applications related to fitness and health, which are usually connected to smartwatches, are of particular value to hackers. These applications collect large volumes of data, including heart rate, number of steps, distance traveled, elevation changes, and, most importantly, geolocation during outdoor workouts.

The expert noted that location and route data could be used for surveillance or stalking, while information about health and physical activity could be used in social engineering schemes or even for blackmail.

How Compromise Occurs

Most often, access to an account is obtained through standard phishing attacks. Attackers may also exploit weak passwords, data leaks from other services, or errors in privacy settings. If an account is compromised, a hacker gains access to the user’s entire workout history, routes, and biometric indicators.

Although there are no separate statistics specifically on smartwatch hacking, the risks should not be underestimated. Estimates suggest that about 70 percent of smartwatch owners use them to monitor their health. Even rare vulnerabilities or user inattention could affect a significant number of people.

How to Protect Your Data

Dmitry Galov recommends focusing first not on the device itself, but on the associated accounts and privacy settings:

• Carefully review the privacy policy of an application before installing it;
• Check what data is collected, for what purpose, and whether it is shared with third parties;
• Regularly check whether the service has experienced data breaches in the past;
• Use strong, unique passwords and enable two-factor authentication;
• Minimize the sharing of sensitive data (especially geolocation) with open or poorly protected services.

In Brief

Smartwatches can become a source of personal data leaks because they are connected to health and fitness applications that collect detailed information about heart rate, routes, and user activity. According to Kaspersky GReAT expert Dmitry Galov, hackers more often target cloud service accounts rather than the devices themselves, typically using phishing or exploiting incorrect privacy settings. The obtained data may be used for surveillance, social engineering, or blackmail. To reduce risks, users should carefully review application privacy policies, use strong account protection, and minimize the sharing of sensitive information.