The Polish data protection authority (UODO) alerts about a phishing campaign impersonating it to collect detailed information on video surveillance systems.

Informed by the Computer Security Incident Response Team (CSIRT GOV), the authority reported that fraudulent emails are sent to companies installing surveillance devices. These messages demand the provision of a complete inventory of installations carried out over the past 12 months, including sensitive data such as end-user contact details, precise geographic location, IP addresses, device serial numbers, and firmware version. The request is presented as an official injunction, setting a seven-day deadline and citing Article 5, paragraph 1, point f, Article 25 and Article 32 of the GDPR to appear legitimate.

The UODO has formally denied being the originator of these communications, stating that it never collects this type of information and does not proceed in this manner. The authority reminds that its genuine requests are part of official procedures, identified by a case number, and are sent by postal mail or via government electronic platforms. Broader investigations are announced on its website, addressed to data controllers and not to installers, and participation is voluntary.