ATHENS — Heliand Devices began recalling its Nera S4 smartphones on 29 September, citing 83 reports of excessive heat after a software update. But tests on returned phones have uncovered a far wider problem: a diagnostic service in the update stored precise location records and sent them to a contractor, even when users had disabled diagnostics.
The company has sold 48,200 Nera S4s in Greece since February, at €189 each (about $221). A review of 37 returned devices found the service had kept recording locations for as long as 21 days after the setting was switched off. The records included timestamps and nearby mobile-network identifiers.
The update behind the recall
The recall followed Heliand’s 18 September release of Asterion 9.3 Preview, a staged software update for the Nera S4. The company blamed a conflict between the update and the phone’s power-management system for the heat reports. On returned devices, however, technicians also found a beta diagnostic module that had remained active in the retail software.
Queenie Hessel, a technician at an Athens consumer repair cooperative, said she examined phones from six owners and compared their settings with the records saved on each device. The location history persisted after a factory reset unless technicians removed a separate system component. “The switch told people one thing; the phone kept doing another,” she said.
The switch told people one thing; the phone kept doing another.
Queenie Hessel, repair technician
Researchers at the Attica Applied Computing Lab counted 3.1 million location entries across the 37 devices and matched upload timestamps with network records supplied by owners. The data went to a cloud server operated by a contractor in Thessaloniki. The researchers said they found no evidence that the contractor sold or published the records, but could not establish how long its server retained them.
What owners were never told
Róselía B. Leons, who bought her phone in March, said she had disabled diagnostics during setup and never knowingly joined a software trial. She brought the handset to the repair cooperative after it grew hot while charging. “I returned it because I thought it might fail. I did not expect a stranger to be able to reconstruct where I had been,” she said.
Heliand spokesperson Vergie P. Grant said the diagnostic module was intended to help engineers identify update failures and that location data was “not used for advertising or sold to third parties”. Grant said the company had removed the service from new downloads and would issue a corrective update by 6 October. Heliand did not answer how many devices had transmitted records or whether the contractor had deleted its copies.
The country’s data-protection regulator has requested technical details from Heliand and the contractor, according to Simon Lindström, a regulator’s office official. The National Device Safety Directorate has advised owners to switch off location services until the update arrives and says it will decide next week whether the recall must cover replacement phones as well as software repairs.
The recall notice tells customers to return their phones to any authorised Heliand service desk for inspection or a replacement. The company has not said whether it will compensate owners for travel or time without a device. For users who trusted a single settings switch to stop tracking, the repair may come too late to answer the most urgent question: who still has the location history?
