Fake UODO letters target CCTV installers, seeking camera IP addresses and serial numbers
Cybercriminals are posing as Poland's Personal Data Protection Office (UODO) and sending companies that install surveillance cameras fraudulent demands for sensitive device data. UODO has warned that it is not running any such campaign.
What the scammers are asking for
CSIRT GOV, the government incident response team led by the head of the Internal Security Agency (ABW), detected the campaign and notified UODO, according to CyberDefence24. The fraudulent messages are sent to firms that fit and service video surveillance systems. Reports say the senders ask for customer contact details, the exact geographic coordinates of installed equipment, IP addresses, device serial numbers, camera models and the version of the firmware in use (Podszywają się pod UODO i pytają o kamery. Urząd ostrzega przed przestępcami – RMF24).
Why the data matters
RMF24 reports that the information would let attackers check whether a device may be running outdated software. If an installer or user has not changed the factory settings, the same data could help criminals take control of the camera, the outlet adds. Cyber portal CyberDefence24 likewise says the details could be used to find vulnerable equipment in company networks.
A letter built to look official
The messages cite Article 5(1)(f), Article 25 and Article 32 of the GDPR, although RMF24 notes that these provisions have little to do with video monitoring. According to the same report, the sender includes a table to fill in and gives seven working days to return a complete list in XLSX format. UODO, as reported by com.pl, says the letters contain figures that are almost correct, which makes them harder to spot (Oszuści podszywają się pod UODO. Wyłudzają dane monitoringu – com.pl).
What the office says
UODO states that it does not conduct such actions and does not send letters of this kind, and it has warned the public against responding, com.pl reports. The office has also described how genuine correspondence looks, so recipients can compare suspicious letters with it.
What companies should do
Firms that receive such a letter should not send any data and should check the sender's identity directly with UODO before responding. Security staff should also verify that installed cameras run current firmware and that default passwords have been changed, since those settings are what the attackers are after.
Sources
- #UODO
- #CSIRTGOV
- #CCTV
- #Phishing
- #DataProtection
- #Poland
- #Cybersecurity