MAC address vendor

Grabango Co — 38:61:A5 (MA-L)

Primary prefix
38:61:A5
Block
MA-L
Status
Ceased operations

Summary

// what this is
Grabango Co is registered to MAC prefix 38:61:A5 in the IEEE OUI database. When a device's MAC address begins with 38:61:A5, that block was registered by Grabango Co — the OUI identifies the maker of the network hardware, which is not always the brand on the device. Grabango Co has ceased operations, but the registration remains on record with IEEE.
// analyst note
A 38:61:A5 address today most likely = legacy Grabango hardware at a former retail partner; vendor no longer exists to issue updates. No Grabango-specific CVEs or CISA advisories found. Apply standard IoT-segmentation posture.
[ 01 ] — Context

About this vendor.

Updated  ·  Confidence: Medium

Grabango Co holds a single MA-L block at OUI prefix 38:61:A5, registered to the company's Berkeley, California address (2000 Allston Way #60, Berkeley, CA 94701, US). Grabango was a US autonomous-checkout vendor founded in 2016 by Will Glaser, a co-founder of Pandora; it built ceiling-mounted computer-vision camera arrays ("g rails") paired with proprietary on-board compute units that ran checkout-free shopping in large retail stores, with commercial deployments at chains including Aldi, Circle K, Giant Eagle, GetGo, 7-Eleven, MAPCO, and Chevron. The company raised roughly $73 million total (a $39 million round in June 2021 was its largest) before ceasing operations in October 2024 after failing to secure continued funding. That defunct status is the operative caveat for this OUI: hardware bearing 38:61:A5 is a networked IoT camera/edge-compute device class, and because the vendor no longer exists, any units still installed at former retail partners receive no further firmware or software updates and should be treated as unpatched IoT endpoints. No Grabango-specific CVEs appear in NVD and no CISA advisories name the brand; category-level concerns are cloud-dependent surveillance data and a broad networked-camera attack surface. Per standard practice, no IEEE registration date is recorded — IEEE publishes none for OUI/MAC blocks, and any third-party "date registered" is a database artifact rather than an IEEE fact.

IEEE assignment
38:61:A5 → Grabango Co, registered Berkeley, CA, US [Confirmed] — IEEE MA-L (local the IEEE MA-L registry: the IEEE MA-L registry)
Registry / block size
MA-L (24-bit OUI) [Confirmed] — the IEEE MA-L registry. NOTE: IEEE's public OUI data publishes NO assignment/registration date; allocated_date stays Unknown and has not been fabricated. Not present in the IEEE MA-M registry (MA-M) or the IEEE MA-S registry (MA-S) — single MA-L assignment.
HQ / country
2000 Allston Way #60, Berkeley, CA 94701, US (registry address) [Confirmed] — the IEEE MA-L registry; corroborated Berkeley, CA HQ [Confirmed] — cbinsights.com, supermarketnews.com
Company / legal name
"Grabango Co." [Likely] — cbinsights.com (single-source legal-name form; registry shows "Grabango Co")
Company status
Defunct — ceased operations October 2024 after failing to secure continued funding; founded 2016 by Will Glaser (Pandora co-founder); raised ~$73M total ($39M largest round, June 2021) [Confirmed] — retaildive.com, pymnts.com
Device types
ceiling-mounted computer-vision camera arrays ("g rails") with proprietary on-board edge-compute units; networked sensors / edge nodes for autonomous checkout in large retail stores — an IoT camera / edge-compute device class
[Confirmed] — supermarketnews.com, edge-ai-vision.com, businessmodelcanvastemplate.com
Notable products
Grabango checkout-free system (camera "g rail" arrays + proprietary compute + Grabango mobile app); deployed at Aldi, Circle K, Giant Eagle, GetGo Café+Market, 7-Eleven, MAPCO, Coen Markets, Chevron [Confirmed] — retaildive.com, paymentsdive.com
Industry
autonomous/cashierless retail checkout; computer vision / AI; retail IoT [Confirmed] — retaildive.com
Website
https://grabango.com (defunct — site certificate error at fetch time; company ceased operations Oct 2024) [Confirmed defunct] — retaildive.com
Security context
no Grabango-specific CVEs in NVD and no CISA advisories naming the brand; category-level concerns are cloud-stored camera/surveillance data in transit and a broad networked-camera (IoT) attack surface; defunct vendor = no further firmware/software patches for legacy hardware still deployed
[Likely] — streetfightmag.com, cbinsights.com
Analyst note
a 38:61:A5 address on a network today most likely indicates legacy Grabango hardware remaining at a former retail partner — the vendor no longer exists to issue updates. Treat as an unpatched IoT camera endpoint; apply standard IoT-segmentation posture. Do not present any third-party "date registered" as an IEEE registration date.
[ 02 ] — OUI prefixes

Assignments by IEEE.

1
// registered prefixes1
  1. 38:61:A5MA-L
[ 03 ] — Related

Keep digging.