Data for 1.2 million people and 200,000 companies stolen in Latvia cyberattack

A major cyberattack in Latvia has resulted in the theft of personal and corporate records for 1.2 million individuals and 200,000 companies, the Road Traffic Safety Directorate (CSDD) said. According to authorities, the breach occurred last week and exposed names, payment information, vehicle registration plates and the address recorded on the day a service was provided.

Government reaction and investigation

Prime Minister Andris Kulbergs said that "it cannot be ruled out that the cyberattack originated in another country." He ordered a full investigation into the incident and publicly criticised the leadership of the CSDD for informing officials about the theft with a delay.

The national cybersecurity agency and the CSDD warned that the stolen records could be exploited by fraudsters, urging citizens and businesses to monitor financial accounts and to report suspicious contacts. Latvia's population is about 1.9 million, meaning the scale of the leak potentially affects a very large share of residents.

Initial reports did not identify who was behind the intrusion. Investigators are examining logs and available forensic data while coordinating with other national and international cyber security partners to determine the origin and scope of the attack.

Officials stressed that notifications and protective steps will be prioritised for those whose payment information or other sensitive data were exposed. The probe aims to establish how access was gained, what systems were compromised and what steps are needed to prevent further misuse of the exfiltrated data.

Photo: DPA