Grabango Co — 38:61:A5 (MA-L)
Summary
- // what this is
- Grabango Co is registered to MAC prefix
38:61:A5in the IEEE OUI database. When a device's MAC address begins with38:61:A5, that block was registered by Grabango Co — the OUI identifies the maker of the network hardware, which is not always the brand on the device. Grabango Co has ceased operations, but the registration remains on record with IEEE. - // analyst note
- A 38:61:A5 address today most likely = legacy Grabango hardware at a former retail partner; vendor no longer exists to issue updates. No Grabango-specific CVEs or CISA advisories found. Apply standard IoT-segmentation posture.
About this vendor.
Grabango Co holds a single MA-L block at OUI prefix 38:61:A5, registered to the company's Berkeley, California address (2000 Allston Way #60, Berkeley, CA 94701, US). Grabango was a US autonomous-checkout vendor founded in 2016 by Will Glaser, a co-founder of Pandora; it built ceiling-mounted computer-vision camera arrays ("g rails") paired with proprietary on-board compute units that ran checkout-free shopping in large retail stores, with commercial deployments at chains including Aldi, Circle K, Giant Eagle, GetGo, 7-Eleven, MAPCO, and Chevron. The company raised roughly $73 million total (a $39 million round in June 2021 was its largest) before ceasing operations in October 2024 after failing to secure continued funding. That defunct status is the operative caveat for this OUI: hardware bearing 38:61:A5 is a networked IoT camera/edge-compute device class, and because the vendor no longer exists, any units still installed at former retail partners receive no further firmware or software updates and should be treated as unpatched IoT endpoints. No Grabango-specific CVEs appear in NVD and no CISA advisories name the brand; category-level concerns are cloud-dependent surveillance data and a broad networked-camera attack surface. Per standard practice, no IEEE registration date is recorded — IEEE publishes none for OUI/MAC blocks, and any third-party "date registered" is a database artifact rather than an IEEE fact.
- IEEE assignment
- 38:61:A5 → Grabango Co, registered Berkeley, CA, US [Confirmed] — IEEE MA-L (local the IEEE MA-L registry: the IEEE MA-L registry)
- Registry / block size
- MA-L (24-bit OUI) [Confirmed] — the IEEE MA-L registry. NOTE: IEEE's public OUI data publishes NO assignment/registration date; allocated_date stays Unknown and has not been fabricated. Not present in the IEEE MA-M registry (MA-M) or the IEEE MA-S registry (MA-S) — single MA-L assignment.
- HQ / country
- 2000 Allston Way #60, Berkeley, CA 94701, US (registry address) [Confirmed] — the IEEE MA-L registry; corroborated Berkeley, CA HQ [Confirmed] — cbinsights.com, supermarketnews.com
- Company / legal name
- "Grabango Co." [Likely] — cbinsights.com (single-source legal-name form; registry shows "Grabango Co")
- Company status
- Defunct — ceased operations October 2024 after failing to secure continued funding; founded 2016 by Will Glaser (Pandora co-founder); raised ~$73M total ($39M largest round, June 2021) [Confirmed] — retaildive.com, pymnts.com
- Device types
- ceiling-mounted computer-vision camera arrays ("g rails") with proprietary on-board edge-compute units; networked sensors / edge nodes for autonomous checkout in large retail stores — an IoT camera / edge-compute device class[Confirmed] — supermarketnews.com, edge-ai-vision.com, businessmodelcanvastemplate.com
- Notable products
- Grabango checkout-free system (camera "g rail" arrays + proprietary compute + Grabango mobile app); deployed at Aldi, Circle K, Giant Eagle, GetGo Café+Market, 7-Eleven, MAPCO, Coen Markets, Chevron [Confirmed] — retaildive.com, paymentsdive.com
- Industry
- autonomous/cashierless retail checkout; computer vision / AI; retail IoT [Confirmed] — retaildive.com
- Website
- https://grabango.com (defunct — site certificate error at fetch time; company ceased operations Oct 2024) [Confirmed defunct] — retaildive.com
- Security context
- no Grabango-specific CVEs in NVD and no CISA advisories naming the brand; category-level concerns are cloud-stored camera/surveillance data in transit and a broad networked-camera (IoT) attack surface; defunct vendor = no further firmware/software patches for legacy hardware still deployed[Likely] — streetfightmag.com, cbinsights.com
- Analyst note
- a 38:61:A5 address on a network today most likely indicates legacy Grabango hardware remaining at a former retail partner — the vendor no longer exists to issue updates. Treat as an unpatched IoT camera endpoint; apply standard IoT-segmentation posture. Do not present any third-party "date registered" as an IEEE registration date.