Cybersecurity Fundamentals

Mars Hydro: An IoT Data Breach

What is IoT

The “Internet of Things”, commonly abbreviated as IoT, essentially is a network of connections that bridge everyday objects and appliances such as smartphones, kitchen appliances, TVs, speakers, and even children’s toys. While IoT has made our lives vastly easier with things such as coffee makers that can be setup to pour your coffee before your feet even touch the floor in the morning, it also opens us up to severe risks. A broad example of these vulnerabilities is that many companies that utilize IoT for their devices often don’t consider that they are opening their customers up for these objects to be “hijacked” by bad actors utilizing things such as the objects MAC address to gain access to a home or company Wi-Fi network to wreak havoc.

The Mars Hydro Breach Explained

Unfortunately, the risks that IoT pose do not exist in a theoretical space, but rather in our every-day lives. Mars Hydro: A Chinese company that produces many IoT devices to include hydroponic grow lights and LED lights was made aware of a massive data breach in February of 2025. This breach on their database could and may have allowed bad actors to gain access to over 2.7 billion personal records to include usernames, email addresses, device information, and activity logs. This breach was not one perpetrated by hackers, but rather a misconfigured cloud storage that allowed this massive number of records to be temporarily publicly available without any authentication in place.

Due to the nature of this breach not being one carried out by a bad actor, the importance of securing our homes and devices in the form of stricter data protection policies, as well as better security practices has been highlighted. Whilst smart home breaches are becoming more common in our every shifting technology-driven lives, the size and scale of this exposed vulnerability has shown experts in the industry that more needs to be done regarding the Internet of Things and the risks that it opens up everyday citizens to. Furthermore, the lack of transparency from the Mars Hydro is also alarming and sheds light upon questionable ethics in the business world as the company had previously claimed that no user data would be collected. However, many would believe the 1.17 terabytes of plain-text Wi-Fi passwords, operating system details, network names, and so forth would say otherwise.

The importance of this breach isn’t necessarily just about the data that was briefly and unfortunately vulnerable, but rather about the unsecure nature of the IoT, and the fact that companies like Mars Hydro have a responsibility to customers to not only be proactive in protecting against breaches such as these, whether due to overlooked security patches, or bad actors attempting to gain access to data for one reason or another. Otherwise, this breach as well as many similar breaches involving the IoT can open up a can of worms to other nefarious activities such as bad actors organizing botnets made up of millions of compromised IoT devices, or in the case of Mars Hydro and their hydroponic grow lights, a devastating physical attack could be utilized in which these actors could coordinate to manipulate the grow lights functionality, cooling units, and fans to actually destroy crops.

What Needs to Change

The Internet of Things is here to stay and will only grow as we move forward from a technological standpoint. Issues such as these are raising the alarm about how unsecure our home and mobile devices can be in a society in which the majority of people have computers in their pockets. It demonstrates that all it takes for millions of people to suffer from pitfalls such as financial ruin all boils down to someone not successfully protecting a singular database present in the cloud. Furthermore, the options that victims of a data breach have can be rather limited. Everyone has heard the spiel in which they must change their passwords, enable security measures such as 2-Factor Authentication (2FA) or even attend trainings on how to recognize social engineering attacks such as phishing scams. It’s obvious what victims need to do after the fact, but unfortunately in our society, many are either technologically illiterate, or simply remain in a complacent mindset in which they follow a misguided mantra of “it’ll never happen to me…. probably”.

Companies ultimately are the ones that should be responsible for the data privacy of the consumers. Potentially unethical practices such as “release now, fix later” is not only present in the gaming industry, but also in the industry that produces and maintains IoT technology. Companies need to ramp up their focus on the important security measures going into their devices such as end-to-end encryption, transparent data policies, and mandatory firmware updates that don’t allow users to continuously hit the “remind me later” button ad nauseum.

What the Future Holds

It has been projected that in just 5 years IoT devices worldwide are expected to reach at least 40 billion.  This statistic is not only impressive, but alarming due to the fact that it also means the question of “will a breach happen” will become obsolete. It will instead turn into a matter of “when will a breach happen?”  Currently, there are roughly 20 billion IoT devices out there and the overwhelming majority of these devices utilize three technologies that almost everyone is familiar with: Wi-Fi, Bluetooth, and Cellular. From a cybersecurity perspective, this is a terrifying statistic. IoT if not already, will soon be an integral part of the majority of the world’s population. Companies like Mars Hydro will need to vastly alter how they handle the data of users and may need some outside oversight to get there as cybersecurity measures aren’t viewed as something worth spending a larger portion of a budget on. Luckily the oversight has been coming through in the form of government legislation that require stricter security measures to be implemented across the board. Earlier this year, the United Kingdom became the first country to release a blanket mandate on IoT cybersecurity standards.

Conclusion

At the end of the day, IoT is not going anywhere and will only continue to grow exponentially with the release of new technologies such as artificial intelligence. Everything smart object in our daily lives that when used may just be a part of our routine such as brewing coffee or telling our google home and Alexa devices to “play Spotify” all utilizes IoT, but more importantly with shoddy security measures, acts as a gateway into our home Wi-Fi networks. However, the human factor also plays a role in data breaches as we saw with the Mars Hydro breach. Something as simple as a misconfigured cloud server can cause chaos in the lives of millions if bad actors catch wind of these vulnerabilities. This simple issue turned out to be a massive oversight for the Mars Hydro as “simple” turned into “substantial” after millions of users’ personal data was suddenly compromised and openly available. Plain-text files with passwords, device information and network names sitting unsecured isn’t just an accident, it’s a failure to plan and stay proactive. Furthermore, the lack of transparency from Mars Hydro was also alarming in that they claimed to have not collected any of this aforementioned data. This gives users a window into just how many companies may be claiming the same thing only for them to wake up and find that their banking credentials were leaked, and their credit cards maxed out. Looking ahead, companies need to ensure that they are putting bigger focuses on their investments into cybersecurity. In 2025 there is no reason why measures such as end-to-end encryption, 2 factor authentication, and automatic updates should not be implemented as a baseline. Furthermore, looking ahead to the not so far off year of 2030 in which it is projected that billions more IoT devices will be out in the world, companies need to start developing disaster plans for cases such as the one at Mars Hydro. Bad actors will always be out there taking advantage of vulnerabilities, and with the sheer number of devices that will be on the market now, and in the future, these vulnerabilities are not a hypothetical situation, but an everyday reality. This vulnerability showcases that no one is safe from a data breach, just ask Ashley Madison users, Yahoo users, or even the world governments, it can happen to anyone indiscriminately. In the end, this write-up isn’t to be an alarmist or dissuade anyone from utilizing IoT devices as they can and have vastly improved our quality of life. However, with the positives come the risks and it is up to these companies that produce these devices to ensure that they are utilizing the latest and greatest cybersecurity technologies and security measures that are available in order to be better prepared for when they are the next target or victim of a breach. I’m sure that Mars Hydro learned their lesson, but unfortunately it was already too late and now millions of their users may pay the price in the future.

References:

Daws, R. (2024, April 29). UK introduces first IOT security laws. Internet of Things News. https://iottechnews.com/news/uk-introduces-first-iot-security-laws/

Cullison, G. (2025, February 27). Mars Hydro IOT breach: 2.7 billion reasons to rethink device security. Home. https://www.qwerx.co/blog/mars-hydro-iot-breach-2.7-billion-reasons-to-rethink-device-security

State of IOT 2024: Number of connected IOT devices growing 13% to 18.8 billion globally. IoT Analytics. (2025, February 10). https://iot-analytics.com/number-connected-iot-devices/

Baran, G. (2025, February 13). Massive IOT data breach exposes 2.7 billion records, including Wi-Fi passwords. Cyber Security News. https://cybersecuritynews.com/massive-iot-data-breach/