CSDD Cyberattack Far Worse Than First Reported: Data of 1.2 Million People Compromised

Varis Teivāns, deputy head of Latvia's cyber incident response institution Cert.lv, has disclosed that the August cyberattack on the Road Traffic Safety Directorate (CSDD) had far more serious consequences than initially reported. Attackers obtained data belonging to approximately 1.2 million people, including information tied to payments made for CSDD services over the past 18 years.

The compromised data included personal information such as identity numbers or registration numbers, first and last names or company names, payment details, payment dates, vehicle license plate numbers, and addresses.

Possible foreign involvement

Speaking to journalists, Prime Minister Andris Kulbergs did not rule out the possibility that the attack could have been carried out by another state, noting that the specific perpetrator has not yet been identified.

What happened

As previously reported, CSDD suffered a complex cyberattack in August that allowed attackers to partially access the directorate's IT systems. This included historical data from payment receipts for services provided by the directorate, CSDD representatives confirmed to the LETA news agency.

Public urged to stay vigilant

CSDD and Cert.lv are urging residents to be especially cautious when receiving emails, text messages, or other communications that appear to come from CSDD. Recipients are advised to verify the authenticity of such messages by checking the official website, e.csdd.lv.

CSDD is a state joint-stock company whose shares are held by the Ministry of Transport. The directorate is responsible for vehicle registration, issuing driving licenses, technical vehicle inspections, and other transport-related services in Latvia.