A Cyprus-registered company is at the centre of a security investigation in Slovakia over the origin and technical capabilities of a new traffic enforcement system.
Although official certification documents identify SODASUS Ltd as the Cyprus-based manufacturer of the NERO R-ONE, an examination by Slovakia’s National Security Authority found that the hardware and software were technologically linked to Russian company Simicon.
The case was reported on 23 August by Swiss newspaper Neue Zürcher Zeitung. According to the newspaper, SODASUS was presented as the manufacturer of the devices, but the subsequent Slovak investigation traced the underlying technology to Simicon, which is based in St Petersburg.
SODASUS in Cyprus
According to the Official Gazette of the Republic of Cyprus, SODASUS Ltd was registered in Cyprus on 24 August 2021 and maintains an office in Strovolos, Nicosia.
The Neue Zürcher Zeitung reported that it was unable to identify any previous substantial commercial activity by the company in Cyprus.
Further details were published on 7 August by Slovak news website Aktuality.sk. Its investigation found that Fidesta Management, a Cyprus-based corporate services provider, was listed as a shareholder.
The outlet also located an earlier listing for SODASUS on a website selling ready-made companies, where it was reportedly offered for sale for €12,000.
Certified as a product of a Cypriot company
The official type-approval certificate for the NERO R-ONE, issued by Slovakia’s Office of Standards, Metrology and Testing, lists SODASUS Ltd, Cyprus, as the manufacturer.
Certificate number 044/1/162/26 was issued on 30 June 2026 and remains valid until 30 June 2036. According to the certification documents, the application was submitted by Slovak company it-s.
Security authority identifies cyber risks
On 14 August, Slovakia’s National Security Authority, known as the NBÚ, issued an official warning of a “significant cyber threat” linked to the use of certain speed-measuring systems.
The products named in the warning included the NERO R-ONE from SODASUS in Cyprus, alongside Cordon systems linked to Russia’s Simicon and Croatia’s NEROline.
The NBÚ said it conducted a technical analysis of a NERO R-ONE unit at the request of Slovakia’s Ministry of the Interior.
The examination identified risks concerning the true origin of the hardware and software, discrepancies between the documented and actual configuration of the system’s communication interfaces, and preconfigured remote-access and management mechanisms.
The authority also found that the software version installed on the device did not match the version listed in its technical documentation.
Twelve Russian phone numbers found
Slovak television channel Markíza, which said it had obtained the NBÚ’s detailed report, revealed that investigators found 12 preconfigured telephone numbers in Russia and an additional undocumented 3G/4G communication module inside the device.
The numbers were reportedly linked to St Petersburg and the Kemerovo region. Technical analysis found that the device was capable of receiving commands through SMS messages.
Markíza also reported that Wi-Fi was active and that images could be transmitted through RTSP without password protection to anyone with access to the device’s network.
Links to Russia’s Simicon
The investigation by Aktuality.sk had already linked the NERO R-ONE to the CORDON PRO.M system produced by Simicon, which is based in St Petersburg.
The Slovak outlet said its investigation into the devices’ origin led from Cyprus and Bratislava to St Petersburg.
The Neue Zürcher Zeitung also reported that the technical examination indicated that Simicon technology was behind the devices’ Cypriot identity.
What the figure of 279 cameras represents
The figure of 279 systems refers to the Slovak Interior Ministry’s broader programme to install automatic traffic enforcement equipment. It does not mean that 279 NERO R-ONE devices had been purchased from SODASUS.
According to information released by the Slovak authorities, only two NERO R-ONE units were undergoing trial operation when the case emerged.
The Interior Ministry has also said that its contracted supplier for the project is Slovak company Soitron, rather than SODASUS directly. Another company in the supply chain is it-s, which submitted the NERO R-ONE certification application listing SODASUS as the manufacturer.
The authorities have not yet published a complete account of the commercial relationship between SODASUS, Simicon and the Slovak companies involved in the supply chain.
They have also not announced any evidence that data were transmitted from the devices to Russia. The NBÚ’s official warning relates to the systems’ technical capabilities, discrepancies from their documentation and the vulnerabilities identified during the examination.
