Latvian Officials Resign After Cyberattack Exposes Data of 1.2 Million People

Major Data Breach in Latvia

Latvia's Road Traffic Safety Directorate (CSDD) announced that a cyberattack resulted in the theft of data connected to approximately two-thirds of the country's population. The breach, which accessed payment receipt data dating back to 2008, affected over 1.2 million individuals and 200,000 businesses and legal entities. Latvia has a population of just over 1.8 million.

Compromised Information and Risks

The stolen information includes personal identification numbers, company registration numbers, vehicle license plate numbers, payment amounts and dates, and addresses from vehicle registration certificates. While customer phone numbers, email addresses, usernames, and passwords were not compromised, Latvia's computer emergency response team (CERT.LV) warned that criminals could use the exposed data for social engineering and fraud schemes.

Official Resignations and Agency Response

The cyberattack prompted calls for senior officials to resign, which subsequently occurred. CSDD stated that its day-to-day operations were not disrupted and services remained available. The agency is continuing its investigation to identify those responsible and has restricted access to a service allowing vehicle information lookups via license plates. CSDD also successfully blocked another attempted cyberattack after implementing security improvements.

Nature of the Attack

CSDD initially disclosed the breach as a "complex" cyberattack where third parties gained partial access to systems containing historical payment receipt data. Varis Teivans, deputy head of CERT.LV, indicated that the attack was targeted and involved prior preparation, suggesting a sophisticated approach by the attackers.