CSDD Cyberattack Exposes Customer Personal Data From Payment Receipts

The Road Traffic Safety Directorate (CSDD) has reported that on August 10, 2026, its IT system suffered a complex cyberattack that allowed an unauthorized third party to access certain customer data stored in payment receipts.

What data was affected

According to CSDD, the exposed information included customers' first and last names or company names, personal identity numbers or company registration numbers, payment amounts and dates, vehicle registration plate numbers, and the address on file at the time the service was provided. The agency stressed that other data — phone numbers, email addresses, banking details, and e-CSDD login credentials — were not affected.

CSDD noted that any customer who has made a payment for its services since 2008 could potentially have had their data compromised. The agency said it is still working to clarify how much of the exposed data remains current, since not all of it may still be up to date. Customers can check which of their records were affected by logging into e.csdd.lv and viewing the "Other payments – payment history" section.

Security measures

CSDD reminded users that its e-services can currently only be accessed through secure authentication methods — eID, eParaksts mobile, eID Scan, Smart-ID, or internet banking. The agency warned that stolen data, particularly personal identity numbers, could be misused for fraud, including attempts to initiate authentication requests through electronic identification tools such as Smart-ID.

CSDD is cooperating with the State Police to help identify those responsible for the attack and has preserved all available information to submit to the Data State Inspectorate for a full assessment. In line with the General Data Protection Regulation, a data breach notice has been published on the agency's website. CSDD encouraged customers to follow updates at www.csdd.lv and to remain cautious with their personal data.