Latvia CSDD cyberattack exposes data of 1.2 million residents
This digest was compiled by AI from multiple sources — links to the originals are below.
A cyberattack on Latvia's Road Traffic Safety Directorate (CSDD) exposed personal data of about 1.2 million people. The breach, which occurred on August 8 or 9, was publicly disclosed on August 13, with full details released later. The CSDD board and supervisory council resigned after failing to notify authorities within 72 hours.
Key Facts
- The cyberattack on Latvia's CSDD exposed personal data of about 1.2 million people, roughly two-thirds of the country's population of 1.8 million.
- Stolen data includes personal ID numbers, names, addresses, license plate numbers, vehicle details, and historical payment records.
- CSDD failed to notify the State Data Inspectorate and Cert.lv within the required 72 hours, leading to the resignation of its board and supervisory council.
- The attack occurred on August 8 or 9, but CSDD publicly revealed it only on August 13, with full scale disclosed four days later.
- On August 27, citizens were finally able to individually check whether and what kind of their personal data was exposed.
Breach Details
The cyberattack on Latvia's Road Traffic Safety Directorate (CSDD) exposed personal data of approximately 1.2 million people, out of a national population of about 1.8 million. The stolen data includes personal ID numbers, names, some addresses, license plate numbers, vehicle details, and historical payment data. The attack occurred on August 8 or 9, but CSDD publicly revealed it only on August 13. It took another four days for the full scale of the breach to be officially disclosed. On August 27, citizens were finally able to individually check whether and what kind of their personal data was exposed.
Official Response
CSDD failed to notify the State Data Inspectorate and the cyber incident response agency Cert.lv within the required 72-hour timeframe. As a result, the CSDD board and supervisory council resigned. The agency has made it possible for customers to familiarize themselves with the personal datasets obtained by the attacker. CSDD also urged people not to share the data publicly and warned that the stolen data can be used in further cyberattacks against individual citizens.
Victim Impact
One victim told Cybernews she was worried but not surprised by the breach, describing the authorities' handling as 'quite bad' with nobody taking responsibility. She said she was probably going to join a class action lawsuit if one is filed and was about to change all her passwords. The victim noted that the scariest part is not knowing where the data has gone, especially regarding potential phishing attempts targeting bank accounts. Experts warn that stolen data could fuel convincing scams, and residents should verify urgent messages through official sites.
1 source
Latvia CSDD cyberattack exposes data of 1.2 million residents
