Polar Electro Oy — 3 prefixes (MA-L)

A MAC address starting with 00:22:D0, A0:9E:1A, or 24:AC:AC belongs to Polar Electro Oy, the Finnish sports-electronics maker, and typically appears on Bluetooth/ANT+ heart-rate sensors, GPS sports watches, and cycling computers rather than on general networking gear.

Polar Electro Oy was founded in 1977 in Kempele, Finland, by Seppo Säynäjäkangas, inventor of the wireless EKG heart-rate monitor. The company now employs roughly 1,200 people across 26 subsidiaries and sells through more than 35,000 retail outlets in over 80 countries, making it a substantive, currently-operating vendor rather than a shell registrant.

IEEE's the IEEE MA-L registry records three separate MA-L allocations for Polar Electro Oy, all registered to the same Kempele, Finland address: 00:22:D0, A0:9E:1A, and 24:AC:AC. No MA-M or MA-S sub-blocks exist for the company, and none of the three is a sub-allocation of a shared IEEE-administered base such as 70:B3:D5 — each is a direct, dedicated assignment.

IEEE's public OUI data publishes no assignment or registration date for any of the three blocks. Third-party tools list dates of 2008-10-25, 2016-04-01, and 2023-12-20 for the respective prefixes, but these are maclookup.app database-crawl artifacts, not IEEE facts, and should not be cited as registration dates.

The one notable security event tied to Polar's ecosystem is application-layer, not MAC-layer: in July 2018 the Polar Flow "Explore" feature let anyone map users' logged exercise routes back to home and work addresses, and a joint investigation used it to identify roughly 6,400 military and intelligence personnel at sensitive sites. Separately, a 2019/2024 academic paper found Polar's Bluetooth heart-rate sensors use device-only authentication, a protocol-level weakness rather than a named CVE.

IEEE assignment

3 prefixes → Polar Electro Oy, registered Kempele, Oulu, FI 90440 [Confirmed] — the IEEE MA-L registry 0022D0, A09E1A, 24ACAC

Registry / block size

MA-L (24-bit OUI) x3; no MA-M/MA-S sub-blocks found [Confirmed] — the IEEE MA-L registry; the IEEE MA-M registry; the IEEE MA-S registry

HQ / country

Professorintie 5, Kempele, Oulu, FI 90440 (registry address); Finland (FI) [Confirmed] — the IEEE MA-L registry 0022D0

Company status

active [Confirmed] — https://www.polar.com/en/about_polar

Device types

heart-rate monitors/chest straps, GPS sports watches, cycling computers, fitness bands, BLE/ANT+ sensors [Confirmed] — https://www.polar.com/en/about_polar, https://en.wikipedia.org/wiki/Polar_Electro

Notable products

H9/H10 heart-rate sensors, Verity Sense, OH1, Polar Loop [Confirmed] — https://www.polar.com/en/about_polar

Verified sample prefixes (all MA-L, Polar Electro Oy)

00:22:D0, A0:9E:1A, 24:AC:AC [Confirmed] — the IEEE MA-L registry 0022D0, A09E1A, 24ACAC; independently corroborated by the Wireshark manufacturer database

Historic block

none identified [Unknown] — no source found naming an earlier Polar Electro OUI

Third-party date artifact

maclookup.app lists 2008-10-25 / 2016-04-01 / 2023-12-20 for the three prefixes; these are crawl-timestamp artifacts, not IEEE registration dates [Likely] — https://maclookup.app/vendors/polar-electro-oy

Security context

2018 Polar Flow "Explore" location-exposure incident (application layer) exposed roughly 6,400 military/intelligence personnel's routes; a separate 2019/2024 academic paper flags device-only BLE authentication in Polar's HR sensor line [Confirmed] — https://www.welivesecurity.com/2018/07/11/polar-flow-app-exposes-geolocation-data-soldiers-secret-agents/, https://arxiv.org/abs/2404.16117

CVE / malware status

no CVE naming Polar Electro recorded in the NVD as of an August 2026 search; no malware/trojan association found as of an August 2026 search [Likely] — https://nvd.nist.gov/

Related vendors

none identified with a separate OUI as subsidiary or sub-allocation [Unknown]

Analyst note

a MAC in 00:22:D0, A0:9E:1A, or 24:AC:AC identifies genuine Polar Electro Oy hardware — these are dedicated MA-L blocks, not shared IEEE-held bases, so the attribution is direct; the vendor's one notable security event was an application/cloud-layer privacy failure, not an OUI/MAC-level defect

[Likely] — synthesized from sources above