Fraudsters impersonate the Personal Data Protection Office and want to extort data

Cybercriminals impersonate the Personal Data Protection Office. There have been false requests, sent on behalf of the Personal Data Protection Office, to send detailed information on video surveillance systems. The Office has never sent such information. 

On Monday, October 19, CSIRT GOV (Computer Security Incident Response Team) informed the Personal Data Protection Office about a campaign aimed at companies installing CCTV. The sender impersonates the Personal Data Protection Office and requests information from the recipients about the installation of video surveillance, including in particular the end-user's contact details, location (including exact geographical coordinates), IP addresses of devices and their serial numbers, as well as firmware version and information about the camera model.

Content of false information:

“Ladies and Gentlemen. In connection with the analysis of the compliance of video surveillance systems with the applicable provisions on the protection of personal data, in particular Art. 5(1)(f), Art. 25 and Art. 32 Regulation (EU) 2016/679 of the European Parliament  and of the Council (GDPR), we ask you to prepare a detailed summary of the installation of video surveillance systems made by your company in the last 12 months..."

In addition, almost correct contact details of our Office are given, there is also a table to fill in (where some sensitive data are to be provided). Finally, there is a reminder:

"Please provide a complete summary in XLSX format within 7 working days of receipt of this letter"

and the phrase:

‘This request is an official summons from the Personal Data Protection Office.’ 

Fraudsters demand to indicate, among others, IP addresses of devices, serial numbers, software versions. Such information allows to determine whether the device may have, for example, outdated software. Criminals can also use the device's factory settings (unless the installer or user has changed them) to take control of it.

The Personal Data Protection Office informs:

·       This e-mail was not sent by the Personal Data Protection Office.

·       The Personal Data Protection Office never sends such letters/surveys, especially in the form of an official request.

·       The Personal Data Protection Office does not collect such information.

This is a classic type of phishing. It is a fraud method in which fraudsters impersonate well-known organisations, companies or institutions in order to extort sensitive data or raise money by means of fake emails.

In this case, the requested information may not only make it possible to determine the addresses of end users, but by taking over the video surveillance system may also affect the safety of persons and property.

We recommend taking special care and verifying each time that the correspondence actually comes from the entity that claims to be its sender.