State agencies weigh replacing license plates after CSDD cyberattack
Several Latvian security and law-enforcement agencies are assessing whether leaked data from a cyberattack on the road traffic authority CSDD threatens their vehicles, with some considering replacing license plates. The breach in early August exposed data on 1.2 million people and about 200,000 legal entities.
Several Latvian institutions that operate vehicles with unmarked plates, including ones used for covert investigations and state security work, are reviewing whether license plate changes are needed following a cyberattack on the road traffic safety directorate CSDD.
The State Police, the largest operational law-enforcement body, has asked CSDD to identify risks tied to leaked data on police-registered vehicles before deciding whether to replace plates on some of them. The Corruption Prevention and Combating Bureau said it is currently assessing possible risks but declined to elaborate further.
The Bureau of Internal Security said it regularly takes measures to protect officials and service vehicles and is now additionally evaluating whether extra security steps are needed because of the data leak. The State Security Service confirmed it has accounted for risks linked to the leaked data and continuously carries out measures to protect both officials' identities and the recognizability of its vehicles, without detailing specific steps.
The State Border Guard said it currently has no information on whether data about its own vehicles was leaked, but as a precaution is assessing the possibility of replacing plates on vehicles used for operational work. The Military Intelligence and Security Service said it is evaluating the potential threat and will take necessary steps to mitigate risks. Some other law-enforcement agencies have not yet responded regarding their vehicle fleet plans.
Background
The cyberattack on CSDD in early August resulted in the theft of data on roughly 1.2 million people and 200,000 legal entities, gathered from payments made to the directorate over the past 18 years. Following the incident, both CSDD's board and council decided that officials should step down after calls to resign. Transport Minister Rihards Kozlovskis has ordered an expedited internal investigation, which will also examine CSDD's cybersecurity contract with Tet. The Prosecutor General's Office has launched a review into possible violations or negligence, while the State Police has opened a criminal investigation into the cyberattack.
