"Trying to cover their tracks": Kulbergs sharply criticizes CSDD over major data breach

Latvia has recorded one of the largest known personal data breaches at a state institution after a cyberattack on the Road Traffic Safety Directorate (CSDD) gave attackers access to data on approximately 1.2 million individuals and around 200,000 legal entities. The disclosure was made to journalists by Varis Teivāns, deputy head of national cyber incident response institution Cert.lv.

Since CSDD's registers hold information on the vast majority of Latvia's drivers and vehicle owners, the scale of the breach means a substantial share of the country's population and businesses could potentially be affected. Few details have so far been made public about exactly what type of data was accessed or how the attack was carried out.

Criticism of the agency's response

The incident has triggered sharp public criticism directed at CSDD, which is accused of trying to "cover its tracks" — that is, downplaying or concealing its own mistakes related to the incident rather than informing the public openly and promptly. The criticism was voiced by Kulbergs, though further context and detail behind the remarks are not yet publicly available.

Cert.lv, as the state body responsible for coordinating cyber incidents, is involved in clarifying the circumstances of the breach. It remains unclear whether and how affected individuals will be individually notified that their data may have fallen into the hands of third parties, and what measures will be taken to prevent similar incidents in the future.

The case again draws attention to the state of cybersecurity at government institutions, given that such systems hold sensitive information on a large portion of society.