CSDD cyberattack: what rights residents have after the data breach
An early-August cyberattack on Latvia's Road Traffic Safety Directorate (CSDD) exposed data of 1.2 million individuals and 200,000 legal entities, prompting the President to call it a major national security threat. Lawyers outline what rights data subjects hold under GDPR.
A cyberattack on the Road Traffic Safety Directorate (CSDD) is being described as one of the most serious information security incidents in Latvia's history. Between August 8 and 10, 2026, attackers gained access to historical payment receipt data dating back to 2008. The breach affects 1.2 million individuals and 200,000 legal entities, and the President has characterized it as a significant threat to national security.
According to information compiled by a legal office, the compromised data likely includes names, personal identity numbers, vehicle registration numbers, registered addresses, and payment information. Experts stress that the greater danger lies not in the breach itself but in how the stolen data may be used afterward — it could circulate on the black market for a long time, enabling highly convincing phishing schemes, such as fake fine notices containing accurate personal details, or attempts to trigger fraudulent "Smart-ID" or "eParaksts mobile" authentication requests.
What rights residents have
Under the General Data Protection Regulation (GDPR), individuals have the right to contact CSDD and request confirmation of whether their personal data was stolen and which categories of data were affected. CSDD must respond free of charge, typically within one month.
If the breach caused real financial losses or significant non-material harm, GDPR allows individuals to seek compensation from CSDD, though it is not awarded automatically — claimants must legally substantiate the authority's violation, the harm suffered, and a clear causal link. If CSDD's response is unsatisfactory or delayed, a complaint can be filed with the State Data Inspectorate, and compensation disputes can be taken to court.
Residents are advised to send an official request to CSDD's data protection officer and to keep records — screenshots, call logs, and related documents — if they receive suspicious messages or calls following the incident. It is important never to approve a "Smart-ID" or eParaksts request that was not personally initiated.
