They impersonate the Office of Personal Data Protection and ask about cameras. The office warns against criminals

Companies installing surveillance cameras targeted

False requests are sent to companies that install surveillance cameras. In them, cybercriminals demand the end-user's contact details, geographical coordinates of installed equipment, IP addresses and serial numbers of devices, as well as information about camera models and software versions. This information allows you to determine whether the device may have, for example, outdated software. If the installer or user did not change anything, thanks to the information obtained, criminals can also use the factory settings to take control over it.

"Almost correct data"

The Office for Personal Data Protection informs that in the content of the message, criminals refer to Art. 5 section 1 letter f, art. 25 and art. 32 of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), which has no major connection with monitoring. They also emphasize that fraudsters provide "almost correct data" to the Office. The message is accompanied by a table where you must enter a number of sensitive data. "Please provide the complete statement in the XLSX format within 7 business days of receiving this letter," the fraudsters urge, lying that "this application constitutes an official request of the Personal Data Protection Office."

Warning against fraudsters, the Personal Data Protection Office informs that "such an e-mail was not sent by the Personal Data Protection Office." "The Personal Data Protection Office never sends such letters/surveys, especially in the form of an official request. The Personal Data Protection Office does not collect such information. This is a classic type of phishing," it was emphasized.

The Office of Personal Data Protection does not address installers

The Office emphasizes that it analyzes how administrators implement specific obligations arising from the GDPR and informs about it in advance on its website. Questions addressed to administrators are of a general and descriptive nature. They are not addressed to device installers, suppliers or services.

The President of the Office for Personal Data Protection (UODO) primarily controls how administrators process personal data and how they secure it. During the proceedings, the office may request additional information. Each such case has its own reference number, and correspondence is handled by the relevant department - by traditional mail, via e-Delivery or ePUAP.