CSDD IT Chief Puriņš Leaves Post After Summer Data Breach
Māris Puriņš, head of the IT department at Latvia's Road Traffic Safety Directorate (CSDD), ended his employment in mid-October. The agency was hit by a cyberattack this summer that exposed the personal data of over a million people.
Māris Puriņš, head of the Information Technology (IT) department at Latvia's Road Traffic Safety Directorate (CSDD), no longer works there, the directorate confirmed to the news agency LETA on 6 November. CSDD is a state-owned joint-stock company that registers vehicles, issues driving licences and carries out technical inspections. The departure follows a cyberattack this summer that led to a large personal data leak.
Mārtiņš Mālmeisters, head of CSDD's communications department, said the employment relationship with Puriņš ended in mid-October 2026. He gave no further details. A competition to fill the vacant post has been announced, with applications accepted until 15 November.
Asked about the internal investigation into the cyber incident, Mālmeisters said it assessed the case from a labour law perspective, reviewing the conduct and duty performance of the employees involved.
Pay and requirements
According to information published on the CSDD website, the monthly pay for the IT department head is set at 6,000–6,500 euros before taxes. Duties include managing the department, developing secure IT and information systems, planning projects and budgets, and overseeing external IT service providers. Candidates must have a university degree in IT, at least three years of team management experience, strong knowledge of IT security, good Latvian and English (at least B2), and be ready to become a state official.
What happened in the summer
The cyberattack struck CSDD overnight into 8 August. Data on 1.2 million individuals and about 200,000 legal entities was obtained, taken from payments made to the directorate over the previous 18 years. On 19 August, both the CSDD council and the management board announced their resignations.
The Prosecutor General's Office opened a prosecutor's review into possible violations or negligence, and the State Police launched a criminal case over the attack. A Ministry of Transport commission concluded that the leak was facilitated by incomplete security testing, insufficient network protection, a lack of multi-factor authentication and shortcomings in software development. It did not assess the responsibility of officials, which falls to law enforcement agencies; its report and materials will be forwarded to them.
