LVM continues recovery efforts after ransomware attack disrupted services

Ongoing Recovery Efforts

Latvia's state-owned forestry company, Latvijas Valsts Mezi (LVM), is in the process of recovering its IT systems following a ransomware attack disclosed in late June. Chief Technology Officer Maris Kuzmins reported that while the situation has stabilized, returning to normal operations is proving difficult.

Impact on Services

The ransomware attack affected several internal and customer-facing services, including LVM's mapping platform and applications related to hunting. Currently, about two-thirds of customers with service contracts have no access to these services.

Details of the Attack

Authorities noted that the attackers had likely infiltrated LVM's network for over a week before detection. The group exploited a vulnerability in software that had not received updates for two years, though specific software details were not disclosed. Importantly, LVM stated they did not receive a ransom demand and would refuse to pay if one was made.

Data Breach Consequences

The attackers leaked approximately 44 gigabytes of data, including internal documents and user credentials. However, CERT.LV suggests that far more information was accessed than what was released. The indictment of a financially motivated foreign group is linked to previous attacks on NATO and EU entities.

Election Infrastructure Security

The attack raised concerns due to LVM's involvement in developing software for Latvia's electronic voter registration system. Authorities have confirmed that election infrastructure remains secure, as related software was developed in an isolated environment separate from LVM's main networks.