Dutch Intelligence Lifts the Lid on a Silent Surveillance Campaign

At least one Russian intelligence service is systematically hijacking internet-connected security cameras across Europe and Ukraine. The feeds aren’t being used to peek at civilians. They’re being used to watch military transport routes, track weapons shipments bound for Kyiv, and pinpoint the locations of Ukrainian troops.

That’s the blunt conclusion of a cybersecurity advisory published July 10 by the AIVD and MIVD, the Netherlands’ civilian and military intelligence agencies. The document pulls back the curtain on a campaign that’s been running quietly for years — and it’s a stark reminder that the cameras meant to protect us can be turned against us.

How the Russian IP Camera Hacks Work

The technique isn’t exotic. It’s a mix of old-school credential stuffing and exploiting known vulnerabilities in camera firmware. Many of the compromised devices are cheap, consumer-grade models that ship with default passwords still active. Others are older enterprise cameras that never received a security patch.

Once inside, the hackers don’t just watch live feeds. They also harvest stored footage, which can reveal patterns: when convoys leave, how often supply trucks roll through, which routes are used at night. Over time, that data paints a detailed picture of logistics that Russian planners can exploit.

Why IP Cameras Are Such a Tempting Target

Think about it. A camera sits in a parking lot near a rail depot. Another one watches a highway interchange. A third overlooks a border crossing. Each one is a tiny piece of a larger puzzle. Individually, they seem harmless. Collectively, they’re a surveillance goldmine.

The advisory notes that the attackers prioritize cameras near military bases, transportation hubs, and weapons transfer points. In Ukraine, the focus is even more direct: locating troop concentrations and tracking the flow of Western-supplied arms.

What the AIVD and MIVD Advisory Reveals

The Dutch agencies didn’t name the specific Russian unit behind the operation, but they were clear about the scale. The campaign targets cameras in NATO member states, Ukraine, and other allied nations. The advisory includes technical indicators of compromise — IP addresses, malware hashes, and exploitation tools — so network defenders can hunt for signs of intrusion.

This isn’t a hypothetical threat. The advisory states that the operation is ongoing and that the intelligence services have observed active exploitation. They’re urging organizations to treat this as a live risk, not a future one.

What This Means for Military Logistics and Supply Chains

For NATO and Ukraine, the implications are serious. If Russian intelligence can see when a convoy leaves a depot or which rail line carries ammunition, they can time strikes more effectively. They can also target logistics nodes with precision, disrupting the flow of supplies that Ukraine depends on.

The advisory specifically calls out the risk to military logistics and the need for better cyber hygiene in defense supply chains. It’s a reminder that physical security and digital security are now inseparable.

A Concrete Example of the Risk

Imagine a camera mounted on a warehouse near a Polish rail yard used for transshipping military aid. If an attacker controls that camera, they see every truck that arrives, every crate that’s loaded. They don’t need a spy on the ground. They have a perfect view from the internet.

That’s the scenario Dutch intelligence is worried about. And it’s not hypothetical — it’s happening.

How to Protect Against Russian IP Camera Hacks

The advisory offers a checklist of defensive measures. Some are basic, but they’re worth repeating because the failure to follow them is exactly how these hacks succeed.

• Change default credentials immediately. This is the number one entry point for attackers.
• Segment your network. Keep cameras on a separate VLAN from critical systems, so a camera compromise doesn’t lead to a network-wide breach.
• Apply firmware patches. Many of the exploited vulnerabilities have had fixes available for months or years.
• Disable remote access. If you don’t need to view cameras from the internet, turn off port forwarding and UPnP.
• Monitor for anomalies. Watch for unusual login attempts or data transfers from camera IPs.

For organizations that operate cameras near sensitive infrastructure, the Dutch agencies recommend a full audit. Assume you’ve been compromised, then check. The cost of a thorough review is trivial compared to the cost of a leaked logistics plan.

The Bigger Picture: A New Front in the Cyber War

This advisory is a window into a broader reality. The war in Ukraine isn’t just fought with missiles and drones. It’s fought with data — who can see what, when, and how fast. Russian cyber espionage has been a persistent threat for years, but the scale and brazenness of this camera hijacking campaign is notable.

The Dutch intelligence services deserve credit for going public. Too often, these findings stay classified, leaving defenders in the dark. By publishing the indicators, they’ve given network defenders a fighting chance.

But the broader lesson is uncomfortable: your security camera might be watching you for someone else. In the age of interconnected devices, every lens is a potential spy. The question isn’t whether attackers will try to exploit them. It’s whether you’ll be ready when they do.

Dutch Regulator Slaps Uber With Record Fine Over Automated Account Bans

Uber is facing a staggering bill after Dutch data protection authorities slapped the ride-hailing company with a fine of 825 million euros ($964 million). The penalty stems from the company’s use of automated software to suspend driver accounts — sometimes permanently — without any human review to catch errors.

The Dutch Data Protection Authority announced the fine on Friday, saying Uber violated the European Union’s General Data Protection Regulation. The GDPR explicitly prohibits fully automated decision-making that significantly affects individuals, and the regulator claims Uber crossed that line repeatedly.

This is the fourth time the Dutch authority has fined Uber. The previous record was set in 2024, when the company was hit with a 290 million euro ($324 million) penalty for transferring personal details of European drivers to the United States without adequate protection.

What Did Uber Actually Do Wrong?

According to the regulator, the violations took place between 2018 and 2022. During that period, Uber’s automated systems could suspend or deactivate driver accounts based on algorithmic assessments. The problem? No human was checking whether those automated decisions were correct.

The authority also said Uber failed to properly inform drivers about how its automatic decision-making worked. Drivers were left in the dark about the very systems that could end their ability to earn a living.

The GDPR’s Stance on Automation

Article 22 of the GDPR gives individuals the right not to be subject to decisions based solely on automated processing when those decisions produce legal or similarly significant effects. In plain terms: if a machine is going to make a call that could cost someone their livelihood, a human needs to be in the loop.

Uber’s system, as described by the regulator, appears to have skipped that step entirely.

Uber’s Response: We Disagree, We’ll Appeal

Uber didn’t take the news quietly. The company said it disagrees with both the decision and the fine, and confirmed it will file an appeal.

“The (Data Protection Authority) examined historic policies that were discontinued years ago,” the company said in a written statement. “We take decisions that affect drivers’ ability to earn extremely seriously and we’re fully committed to fair treatment. This includes human reviews, robust safeguards, and the opportunity for drivers to appeal our decisions if they believe we made a mistake.”

The company’s argument hinges on timing — it claims the practices in question were old and already scrapped. The regulator, however, maintains that the violations happened on its watch and that the fine is justified.

What This Means for the Gig Economy

This ruling sends a clear signal to every platform that relies on algorithmic management. If you’re using automated systems to make decisions about workers — whether they’re drivers, couriers, or freelancers — you need human oversight and transparent communication.

The fine is a reminder that GDPR isn’t just about data breaches and consent pop-ups. It’s also about protecting individuals from the whims of opaque algorithms. For companies like Uber, Lyft, and DoorDash that have built their business models on algorithmic matching and rating, this is a warning shot.

Related: Personal Information Exposed in Apollo Global Data Breach

Related: TikTok Reaches $400 Million Settlement With US Justice Department Over Children’s Privacy

The Bigger Picture: A Growing Regulatory Crackdown

Uber has been in the crosshairs of European regulators for years. The 2024 fine over US data transfers was itself a landmark penalty. Now this new fine nearly triples that amount.

The pattern is clear: European authorities are getting serious about enforcing data protection rules against Big Tech. And they’re not afraid to use their calculators.

For Uber, the appeal process could drag on for years. But even if the fine is reduced or overturned, the reputational damage is done. The message to the industry is simple: algorithmic decisions need human accountability.

Related: Google Cloud Sets Out Post-Quantum Roadmap With 2029 Readiness Goal

What Drivers Should Know

If you’re a driver for any ride-hailing platform, this case highlights your rights. Under GDPR, you have the right to:

• Know when automated decision-making is being used on you
• Request human intervention in automated decisions
• Express your point of view and contest automated decisions
• Receive meaningful information about how the algorithm works

If a platform isn’t providing these protections, it may be in violation of the law. The Dutch regulator just proved that with a nearly billion-dollar exclamation point.

The Dutch Data Protection Authority has set a precedent that other European regulators may follow. For Uber, the fight is just beginning. For the rest of the gig economy, the lesson is already written.

A Single Request Shouldn’t Do This Much

One request. That’s all it took this week to turn a WordPress site into a hacker’s playground. Or to wipe a SonicWall firewall’s memory. Or to steal keys from an AI service. Small inputs, catastrophic outputs — the theme of the last seven days in cybersecurity.

Let’s be clear: this wasn’t a quiet patch-Tuesday lull. Attackers were already exploiting some of these flaws before defenders even got a heads-up. Others are fresh research, but the risk is immediate. Here’s what you need to know, in order of “drop everything” urgency.

WordPress RCE: The One-Click Backdoor

The headline grabber is a serious WordPress RCE vulnerability. Researchers demonstrated that a single, unauthenticated request could lead to remote code execution on a vulnerable site. No credentials, no special access, just a carefully crafted packet.

The root cause? A weak check in a popular plugin’s input handling. It’s the kind of bug that’s trivial to find with automated scanning, which means it’s already being probed in the wild. If you run WordPress, your next step isn’t optional: update every plugin and theme today. Not tomorrow.

Patch Priority: WordPress Core and Plugins

• Update WordPress core to the latest version immediately.
• Audit all installed plugins — remove any that are abandoned or no longer maintained.
• Enable automatic updates for plugins, or at least set up a weekly manual check.

Remember: the plugin is the weak link, not the core. Most WordPress RCE attacks in 2025 target third-party code.

SonicWall 0-Days: Memory Loss, Then Full Compromise

SonicWall’s firewalls are the workhorses of small and mid-sized businesses. That’s why two newly disclosed SonicWall 0-day vulnerabilities hurt so much. One allows an attacker to cause a denial-of-service by exhausting memory. The other? It goes further — potential code execution with elevated privileges.

What makes these nasty is the attack surface. Firewalls are exposed to the internet by design. There’s no “internal only” mitigation. SonicWall has released patches, but the window between disclosure and exploitation is shrinking. In the past 48 hours, security researchers have already seen exploit attempts against unpatched devices.

What to Do Right Now

Check your SonicWall management interface. If it’s reachable from the internet, restrict it to a VPN or allowlist immediately. Then apply the vendor’s firmware update. This isn’t a “schedule it for next month” situation.

AI Service Attacks: When the Model Turns Against You

It wasn’t just traditional infrastructure under fire. This week also saw a wave of AI service attacks — specifically, prompt injection and model manipulation that led to data exfiltration. One incident involved an attacker stealing API keys by tricking a chatbot into outputting them. That’s not a sci-fi hypothetical; it’s a live attack pattern.

The problem is trust. Companies are connecting LLMs to internal databases, email, and code repositories, but they’re not always validating the model’s output. A malicious prompt can turn a helpful assistant into a data-leaking tool. The fix isn’t to abandon AI — it’s to treat the model as untrusted user input.

Mitigations for AI Services

• Never let an LLM directly access sensitive data without a middleware layer that filters output.
• Rotate API keys frequently and use separate keys for different services.
• Monitor logs for anomalous model behavior — like sudden requests for private keys.

SharePoint 0-Day: The Corporate Backdoor

Microsoft’s SharePoint also had its moment in the spotlight. A SharePoint 0-day vulnerability allows an authenticated attacker to escalate privileges and potentially read or modify documents they shouldn’t touch. Given that SharePoint is the document backbone for countless enterprises, this one has a wide blast radius.

The attack requires authentication, which narrows the pool of attackers. But insider threats exist, and credential theft is common. If you’re running SharePoint Server (not just the cloud version), check for the latest cumulative update. Microsoft’s advisory includes specific workarounds if you can’t patch immediately.

Old Drivers, Fake Prompts, and Public Code

Beyond the big names, the week’s smaller stories followed familiar patterns. Old drivers with known vulnerabilities were used to disable security tools — a classic BYOVD (Bring Your Own Vulnerable Driver) attack. Fake prompts tricked users into granting permissions they’d never give a stranger. And public code repositories were abused to distribute malware, hiding malicious payloads in seemingly innocent open-source projects.

None of these are new techniques. But they keep working because patching is slow and users are distracted. The lesson: security hygiene isn’t about fancy tools; it’s about basics done consistently.

What to Patch First: A Quick Priority List

If you only have an hour this week, spend it here:

1. WordPress plugins and core — the RCE is actively exploited.
2. SonicWall firewalls — exposed devices are low-hanging fruit.
3. SharePoint Server — patch if you’re on-premises.
4. Rotate AI service keys — assume a prompt injection already happened.

One request shouldn’t be able to do this much damage. But it can, and it will, unless you close the gaps. Patch now, audit your exposure, and don’t wait for the next weekly recap to tell you what broke.