Ukraine’s Computer Emergency Response Team (CERT-UA) has warned that attackers have obtained unauthorized remote access to Dahua video surveillance systems, including IP cameras and DVRs. According to the alert, recorded incidents involved access to video streams, changes to device configuration and the creation of third-party accounts on affected systems.

While the reported activity comes from Ukraine, the underlying issue is relevant well beyond one market. Many European businesses use internet-connected cameras, digital video recorders and cloud-managed surveillance systems in offices, warehouses, retail sites and logistics operations. If remote access and account controls are weak, these devices can become an entry point for surveillance abuse, operational disruption or broader network risk.

What happened

CERT-UA said it has observed cases involving Dahua surveillance equipment where attackers were able to access systems remotely without authorization. The agency reported that incidents included:

• Viewing video streams
• Changing device configuration
• Creating unauthorized additional accounts

Based on the source information, the alert points to abuse of peer-to-peer (P2P) access and authentication weaknesses. That matters because P2P connectivity is often used to simplify remote access to cameras and recorders without complex network setup. In practice, convenience features can also increase exposure if they are not tightly controlled or if authentication is insufficient.

The source does not establish that every Dahua device is affected in the same way, and businesses should avoid assuming uniform impact across all models or deployments. The key confirmed point is that unauthorized access cases have been recorded and that the vendor’s surveillance ecosystem is under scrutiny in this context.

Why it matters for European businesses

Video surveillance is no longer just a physical security tool. In many companies it is part of a wider connected environment that includes office networks, retail infrastructure, industrial sites, access control, cloud dashboards and mobile administration tools. A compromise can therefore have consequences beyond camera footage.

For European businesses, the main risks include:

• Privacy and data protection exposure: Unauthorized access to live or recorded video may involve personal data, including employees, visitors and customers.
• Operational disruption: Changes to camera settings or recorder configurations can reduce site visibility, disrupt security workflows or interfere with incident response.
• Persistence through rogue accounts: If attackers create additional user accounts, they may retain access even after a password change on a primary account.
• Broader cybersecurity risk: Internet-connected devices with weak security can increase attack surface, especially if they share networks with business systems.

For regulated sectors or businesses operating critical sites, compromised surveillance infrastructure may also trigger internal reporting, supplier risk reviews or security control reassessment. Where video systems process personal data, GDPR-related obligations may become relevant depending on the nature and impact of the incident.

Who may be affected

The alert is most relevant to organisations that use Dahua IP cameras, DVRs or related remote-access surveillance deployments. This may include:

• Retailers and e-commerce operators with warehouses, stores or fulfilment sites
• SMEs using low-cost internet-connected camera systems for office or site security
• Manufacturing and logistics businesses monitoring facilities remotely
• IT and security teams responsible for connected devices, edge hardware or segmented networks
• Service providers and digital integrators that deploy or maintain surveillance systems for clients

Businesses may face higher exposure if devices are reachable from the internet, if P2P access is enabled by default, if remote administration is widely shared across teams, or if old accounts remain active after installer or staff changes.

What companies should consider

Companies using connected surveillance systems should treat the CERT-UA alert as a prompt to review both technical exposure and administrative controls. Practical steps may include:

• Inventory affected devices: Identify Dahua cameras, DVRs and related management components across offices, shops, sites and third-party managed locations.
• Review remote access settings: Check whether P2P features, cloud access or direct remote administration are enabled, and confirm whether they are still required.
• Audit accounts: Look for unknown, inactive or legacy user accounts, especially accounts created by installers, contractors or former staff.
• Reset credentials where appropriate: If compromise is suspected, rotate passwords and review multi-user access practices.
• Check vendor guidance: Monitor official vendor and national CERT advisories for model-specific remediation steps, firmware updates or configuration recommendations.
• Segment surveillance systems: Avoid placing cameras and DVRs on the same network segment as core business applications where possible.
• Review logging and retention: Confirm whether administrative activity, login attempts and configuration changes are logged and can be reviewed.
• Prepare an incident response path: If unauthorized access is detected, preserve evidence, isolate exposed devices and assess possible privacy implications.

For SMEs, the most important immediate question is simple: can anyone access surveillance devices remotely who should not be able to? If the answer is unclear, a focused access review is likely justified. Businesses that rely on managed security or facilities suppliers should also ask those providers to confirm what remote access methods are enabled and what controls are in place.

The broader lesson is that cameras, recorders and other connected operational devices should be managed as part of the organisation’s cybersecurity posture, not treated as standalone physical hardware. As attackers continue to target edge devices, surveillance systems remain a practical weak point for businesses that prioritise convenience over access control and network hygiene.