The National Cyber and Information Security Agency (NÚKIB) issued a warning on September 3, 2025, regarding a cybersecurity threat consisting of the transfer of system and user data either to the People's Republic of China and its Special Administrative Regions or to entities based in these territories, and the remote administration of technical assets carried out either from the territory of the People's Republic of China and its Special Administrative Regions or by entities based in these territories (hereinafter the “PRC and its SARs”).
NÚKIB identified the security threat from the following:
- The increasing share of complex technological solutions in critical sectors and services that transfer data to the PRC or are remotely managed from the PRC. The penetration of these technologies and devices into critical sectors (such as transportation, energy, healthcare, public administration etc.) is growing and will continue to grow in the future. Current critical infrastructure systems are increasingly dependent on data storage and processing in cloud storage and on network connections that enable remote operation and updates. In practice, this means that technology solution providers can significantly influence the operation of critical infrastructure and/or access important data, making trust in the reliability of the provider absolutely crucial.
- The increasing number of devices connected to the internet, which also transfer data and are remotely controlled by their suppliers. Examples of risky products and services that may transfer data to the PRC or are managed from there include IP cameras, photovoltaic inverters, so-called "smart meters", medical technologies, cloud storages, highly complex personal devices (phones, watches), connected vehicles (electric cars), large language models etc.
- Confirmed malicious activities by actors linked to the PRC directed against the Czech Republic, as well as the EU Member States and NATO Allies. Recent examples include a cyber campaign against the Ministry of Foreign Affairs of the Czech Republic, led by the APT31 group associated with the Chinese intelligence service Ministry of State Security since at least 2022. This campaign led the Czech government to conduct a public attribution.
- The political and legal environment of the PRC, which, among other things, allows Chinese government authorities access to data stored on the territory of the PRC or significant interventions by Chinese government authorities in the operation of private companies, or provides these government authorities with tools to enforce the cooperation of private companies in the espionage activities of the PRC. The same problematic legal regulation is also applicable to the territories of PRC’s SARs, namely Hong Kong and Macau, due to their close legal and operational connection.
The warning does not represent a direct ban of use of technologies transferring data or enabling a remote administration from PRC and its SARs; entities obligated under Czech Act on Cybersecurity must take the threat into account in their risk analyses and respond to the identified risks by implementing adequate security measures.
At the same time, NÚKIB also recommends that the public carefully assess the use of the affected products and technologies, or alternatively, consider what kind of information they put into them or what activities they use them for.
The threat is rated as ‘High’, corresponding to a probability ranging from likely to very likely (3 out of 4).
You can find the full text of the warning here: https://nukib.gov.cz/download/publications_en/EN_2025-09-03_warning.pdf