in-depth: Sears Exposed AI Chatbot Phone Calls and Text Chats to

Sears Home Services, the enduring appliance repair division of the historic retailer, inadvertently exposed millions of customer interactions with its AI chatbot, "Samantha," online. Security researcher Jeremiah Fowler recently uncovered three publicly accessible databases containing 3.7 million chat logs, alongside 1.4 million audio files and their plain text transcripts, detailing sensitive personal information. The exposure, which spanned data from 2024 to early 2026, highlights significant privacy vulnerabilities as companies increasingly deploy artificial intelligence in customer service roles.

Unsecured Customer Data

The compromised databases, swiftly secured following Fowler's notification in early February, contained an alarming breadth of customer data. This included full names, phone numbers, residential addresses, types of appliances owned, and specifics regarding delivery appointments and repair schedules. Chats were recorded in both English and Spanish, with the AI technology identified as "kAIros." Fowler, a researcher with Black Hills Information Security, emphasized that such information is a goldmine for scammers aiming to launch sophisticated phishing attacks or commit identity fraud.

Fowler noted his surprise and alarm at discovering the public accessibility of these massive data troves. He stressed the imperative for companies, even when leveraging AI for cost savings, not to compromise on data protection. "At the bare minimum, these files should have been password protected and encrypted," Fowler asserted, highlighting fundamental security oversights.

Unsettling Extended Recordings

Beyond the direct chat logs, a particularly troubling aspect of the leak involved numerous audio recordings. Fowler discovered that many of these calls continued to record for extended periods, some up to four hours, long after customers seemingly concluded their interactions with the AI agent. These prolonged recordings inadvertently captured ambient household sounds and private conversations, exposing intimate details that customers undoubtedly believed were confidential within their homes. "You could hear the TV playing, you could hear people having conversations, and this recorded all of it," Fowler noted, underscoring the profound invasion of privacy.

Customer Frustration with AI Bots

The exposed data also offered a glimpse into customer experiences with the AI chatbot, often marked by frustration. Transcripts and audio files revealed instances where users, after just minutes, pleaded to speak with a human representative, only to be told by Samantha that a live agent might involve a "short wait." In one lengthy exchange, a customer repeatedly typed, "Where's my technician?" 28 times, eventually resorting to calling the bot "a computer" out of exasperation. This highlights the double-edged sword of AI deployment: while it promises efficiency, glitches and inability to resolve complex issues can lead to significant customer dissatisfaction and a breakdown of trust.

Corporate Response and Broader Implications

Transformco, the parent company of Sears and Sears Home Services, quickly secured the databases after Fowler's disclosure but has yet to issue a public statement or respond to WIRED's requests for comment. Fowler's attempt to contact a "Samantha AI Chatbot manager" also went unanswered. This incident serves as a stark warning to businesses rapidly integrating generative AI into their operations.

Carissa Véliz, an author and associate professor at the University of Oxford, underscores the need for companies to offer customers genuine choices, such as the option to speak with a human or decline conversation recording. As Véliz states, ensuring customer safety and comfort, rather than alienation and exploitation, should be the long-term goal. The Sears leak powerfully illustrates the critical balance required between technological advancement and robust data security, a lesson increasingly vital in an AI-driven world.

FAQ

Q: What specific customer data was exposed in the Sears leak? A: The exposed databases contained personal information including customers' names, phone numbers, home addresses, details about their appliances, and information related to delivery appointments and repairs.

Q: How long were the Sears chatbot databases exposed online? A: It is currently unclear how long the databases were publicly accessible. Security researcher Jeremiah Fowler discovered them in early February, and they were secured shortly after he notified Transformco, the parent company. The data itself spanned from 2024 to early 2026.

Q: Why are the extended audio recordings particularly concerning? A: Many audio recordings continued for up to four hours after customers believed their calls with the AI chatbot had ended. These extended sessions captured ambient sounds and private conversations within customers' homes, potentially revealing highly sensitive personal details that individuals thought were private.