In May 2026, the Yarbo case shook the connected robotics industry. A security researcher showed how thousands of robot mowers made by the Chinese company Yarbo could be hijacked with ease. The exposed data included GPS coordinates, Wi-Fi passwords, email addresses and much more. Yarbo responded with a detailed 1,200-word statement, confirming the vulnerabilities and announcing a corrective plan.
But the case goes beyond a single product. It's a warning sign for any SME that uses network-connected IoT devices, from industrial machinery to video surveillance systems and logistics sensors. The attack surface grows with every device you add, often without proper security policies. As a result, the operational implications for Italian companies are concrete and urgent.
At SHM Studio, we track these trends to help SMEs understand the digital risks that come with technological transformation. In this analysis, we walk through the timeline of the case, identify the real winners and losers, and offer a strategic perspective for mid-sized businesses.
The timeline: from a runaway mower to a global reputation crisis
On May 7, 2026, The Verge published a detailed investigation into how a security researcher managed to take remote control of a Yarbo robot mower. The device, which has rotating blades, was turned against its own owner. The episode immediately drew global media attention.
The next day, Yarbo released a public response of about 1,200 words. The company confirmed the vulnerabilities reported by the researcher. It also issued a formal apology and outlined a structured action plan to fix the issues identified. As a first immediate step, Yarbo temporarily disabled remote access to its devices.
In parallel, the cybersecurity community began mapping the scale of the problem. Thousands of Yarbo devices turned out to be exposed. The data at risk included real-time GPS coordinates, Wi-Fi credentials, registered users' email addresses and other personal information.
Anatomy of the vulnerability: why it was so easy to exploit
The flaws found in the Yarbo system weren't sophisticated. On the contrary, they were basic architectural errors. Access to the remote control API didn't require strong authentication. So anyone with elementary technical knowledge could intercept and replay the control calls.
What's more, users' sensitive data was transmitted in clear text or with insufficient encryption. In particular, the Wi-Fi passwords stored on the device could be retrieved without any special privileges. This type of error ranks among the most critical vulnerabilities under the OWASP IoT Top 10 standards.
The Yarbo case is not isolated. According to recent research by Gartner, over 60% of consumer and semi-professional IoT devices have at least one unpatched critical vulnerability. The problem, then, affects an ecosystem far larger than the single brand involved.
Winners and losers: who comes out stronger
Yarbo's response was timely and detailed. That's a positive in handling the crisis. Still, the brand's reputation has taken significant damage, one that will be hard to repair in the short term in the European and North American markets.
The direct losers are clear: Yarbo as a brand, the resellers who bet on the product, and more broadly the entire category of connected garden robots. Consumer trust in these devices will inevitably slow down over the coming weeks.
The unexpected winners are IoT security vendors and consultants specializing in cybersecurity for OT/IoT environments. Likewise, manufacturers that had already invested in security certifications such as IEC 62443 or the NIST framework for IoT come out stronger. In short, those who did their homework can now stand out with credibility.
A third group of winners, less obvious, is independent security researchers. The Yarbo case shows the concrete value of responsible disclosure and strengthens the legitimacy of bug bounties as an industry practice.
The SHM Studio take: the risk isn't the robot, it's the model
At SHM Studio, we work every day with Italian SMEs going through digitalization. We see a recurring pattern: companies invest in connected devices, such as smart machinery, IP cameras and warehouse sensors, without building a parallel security governance.
Related articles
Discover more articles exploring similar topics, selected to offer you a more complete and stimulating perspective. Each piece of content is carefully chosen to enrich your experience.
