"It's a failure to correctly check that the person logged in to the account is the person authorised to access that data," Mr Munro said in an email. "As a result, anyone can access anyone else's data."

Mr Munro and Mr Hunt both described the flaw in detail on separate blog posts on their respective websites. Mr Hunt also filmed a video of his six-year-old daughter Elle using the watch as it was remotely accessed by an unauthorised third party, who spoke to her.

Loading

"If you can count you can exploit this risk," Mr Hunt said, describing how the flaw meant it was as easy as changing a number in a URL address to access another child's smartwatch.

"I would never buy one of these watches for my children.

"The only reason I bought this was to demonstrate the flaw. If I were a parent who bought one with the intention of using it I would return it and ask for a refund."

Loading

The watch, which requires a SIM card and monthly subscription of between $6 and $20, has been on sale in Australia since 2014 and makes use of hardware made by Chinese company Gator.

The software was developed in partnership with Sri Lanka-based Nibaya, although Ms Cantwell said TicTocTrack dealt with the head of the company's development team in Perth.

On Monday evening, Ms Cantwell labelled as "a generalisation" the researchers' explanation of what they said they were able to do with the flaw.

"This is yet to be confirmed as an issue beyond the penetration testing conducted by Ken Munro," Ms Cantwell said, declining to reveal how many TicTocTrack smartwatches have been sold in Australia.

Earlier this month, Ms Cantwell told ABC News that sales had increased by 600 per cent over the past three years. Mr Hunt estimates sales could be around 3500 if the number assigned to the watch he bought was sequential. "We'll pass on this question," Ms Cantwell said when asked.

In an email to users and a media statement on Monday, Ms Cantwell said there had "never been a security breach that has led to our customers' personal data being used for malicious purposes".

Ms Cantwell added that as soon as a technical assessment had taken place, she would release a report detailing what security issues were apparent and what steps it would take and when.

"We hope to have the service back up and running by close of business Wednesday the 17th of April however will continue to keep you informed as we progress through our investigations," she said.

In another statement on Tuesday afternoon, Ms Cantwell said her company had received additional information from the researchers that had allowed it to further investigate.

"Any and all security issues are being addressed and will be fixed as soon as possible," she said.

In addition to receiving money from the Queensland government, Ms Cantwell's company is a registered National Disability Insurance Scheme provider.

In November 2017, news website WeLiveSecurity reported that German parents were being told to destroy smartwatches they bought for their children after the country's communications regulator put a ban in place to prevent their sale following revelations about similar security flaws.