CSDD hit by cyberattack, historical receipt data stolen
Over the weekend, attackers partially breached the IT systems of Latvia's Road Traffic Safety Directorate (CSDD) and extracted historical payment receipt data containing personal information. The agency, working with CERT.LV, has stopped the attack, and customer passwords were not affected.
Latvia's Road Traffic Safety Directorate (CSDD) was targeted by a cyberattack over the weekend, during which attackers gained partial access to the agency's IT system. As a result, historical payment receipt data related to CSDD services was extracted without authorization. The compromised records included certain personal data — personal identification or registration numbers, first and last names or company names, payment amounts, payment dates, vehicle license plate numbers, and addresses.
CSDD's IT team, working with cybersecurity institution CERT.LV, has halted the attack and implemented several improvements to the system's security to prevent similar incidents in the future.
Attack described as targeted
Māris Puriņš, head of CSDD's IT department, said the methods and channels used by the attackers have been identified and fully blocked. He emphasized that customer usernames and passwords were not affected, so no further action is required from clients. CSDD urged the public to remain cautious and verify any information received through e.csdd.lv.
Varis Teivāns, deputy head of CERT.LV, explained that the investigation is ongoing and the exact circumstances of the attack are still being clarified. However, information gathered so far suggests the attack was targeted, involved prior preparation, and demonstrated a high level of technical competence on the part of the attackers. He warned that the stolen data could be used for further targeted fraud attempts, urging residents to be especially vigilant toward emails, text messages, or other communications appearing to come from CSDD.
The incident has not affected CSDD's in-person or e-services, which continue to operate as usual. CSDD has notified other relevant state authorities, including the State Data Inspectorate, about the cyberattack. Residents with further questions can contact CSDD at datu.specialists@csdd.gov.lv.
