Latvia's data regulator has no information on Latvian travellers' data on Russian black market

Latvia's Data State Inspectorate (DVI), the authority that oversees personal data protection, currently has no information indicating that the personal data of Latvian travellers has ended up on a Russian black-market data platform. The agency made the statement in connection with a recent investigation by Lithuanian media.

What Lithuanian media found

The Lithuanian portal Delfi.lt reported last week that personal data of Lithuanian travellers had appeared on the platform. Its investigation found publicly accessible information including names, dates of birth, phone numbers, passport details and travel information. The leaked data covers trips from Lithuania to Turkey, Greece, Spain and other destinations between 2012 and 2026.

The records were linked to the tour operators Tez Tour and Join Up, as well as travel agencies that work with them: Makalius, Kelioniu ekspresas, West Express, Noriu atostogu, Kelionu akademija, Baltic Tours and Amberturas.

The inspectorate's position

The DVI says it has no data showing that such a breach affected customers in Latvia. The relevant service providers have also not reported such a breach to the inspectorate. "Therefore we cannot confirm whether it has affected Latvian customers as well, or provide information on the possible scale," the DVI said.

Earlier developments

In mid-September, a hacker group calling itself DataSuckers claimed responsibility for breaking into the systems of the tour operator Tez Tour in Russia and Belarus. According to media in those countries and the hackers themselves, around 395.5 million records were downloaded and destroyed. These include about 45 million reservations, almost 22 million travel bookings, about 52 million hotel bookings and 252 million financial transaction records.