Fake UODO emails seek CCTV installers’ maps of cameras and vulnerable devices

Poland’s data protection authority has warned CCTV installers that criminals are posing as officials to obtain customer details, site locations and technical information that could expose surveillance systems to attack.

Cybercriminals are posing as Poland’s Personal Data Protection Office, known as UODO, in a phishing campaign aimed at firms that install CCTV systems. According to UODO and reports in the Polish press, the fake emails ask recipients to provide information on completed installations, including customer contact details, precise site locations, camera IP addresses, serial numbers, models and firmware versions. The office said it did not send the requests and warned that the messages are intended to look like formal government correspondence.

The emails are crafted to appear authoritative. UODO said the texts cite provisions of the GDPR covering security of processing, data protection by design and confidentiality, and include contact details designed to resemble official ones. Recipients are given a short deadline and asked to return the material in spreadsheet form, a tactic that appears intended to pressure businesses into responding without checking whether the request is genuine. Security specialists say the information sought could help attackers build a detailed map of surveillance systems and identify devices that may be vulnerable to unauthorised access.

The data being requested is particularly sensitive because it goes beyond basic administrative records. Polish media reports indicate the fraudsters are seeking the end users of surveillance systems, installation addresses and geographic coordinates, along with technical details that can reveal whether devices are exposed on the internet or running outdated software. If criminals obtain that combination of information, they may be able to target live feeds, alter configurations or interfere with security systems protecting homes, businesses and public institutions.

UODO has stressed that it does not send mass questionnaires to CCTV installers asking for this kind of information. The authority said official requests in formal proceedings carry case references and are issued through standard channels such as postal delivery or electronic systems including e-Doręczenia and ePUAP. It also noted that its compliance checks are normally announced in advance and tend to involve broader questions directed at data controllers, not the sort of detailed technical inventory being demanded in the phishing emails. Firms that receive such messages are being urged to verify the sender independently and to consider whether any disclosure could amount to a personal-data breach under the GDPR.