Fake UODO emails seek CCTV system data

Poland’s data protection authority UODO warned on 20 October 2026 about emails sent to CCTV installers. The senders impersonate the authority to obtain surveillance system information.

What the messages request

Requested details include locations, IP addresses, serial numbers, device models and customer data. UODO says it did not send these requests and is not conducting the purported survey.

Verify through an independent channel

Before sharing documentation, verify the request through contact details you independently find on the official website. A logo or email signature does not establish identity. Within a company, send the suspicious message to the person responsible for security before anyone responds.

Why would an attacker want an equipment inventory?

The request goes beyond contact details. A combination of location, model, serial number and firmware version can connect a device to a specific site and help identify weaknesses. UODO says this information could help attackers take control of cameras. A request that does not ask for a password can still create a security risk.

We suggest separating two decisions: first establish whether the authority really has such a case, then determine what information may be disclosed. The first step requires contact details obtained independently of the suspicious message. A deadline and official-looking email design cannot substitute for confirmation.