Police: Criminal Case Against Cybersecurity Expert Strazdiņš Not Related to LVM Attack

The State Police have commented on social media that the criminal case initiated against software engineer and cybersecurity expert Elvis Strazdiņš is not directly linked to the cyberattack on the infrastructure of “Latvijas valsts meži” (LVM). Police found that an unrelated individual had arbitrarily and without authorization impersonated an LVM representative, acting on behalf of state institutions without any mandate.

Last week, Strazdiņš publicly explained the hacker attack on LVM servers, publishing a conversation with the hacker who demanded €600,000 for data decryption. He noted that legally it is not extortion because the hacker did not directly contact LVM, but in other channels he invited contact. Strazdiņš personally communicated with the hacker, who requested 0.1% of LVM’s annual revenue – €618,600 (based on 2025 revenue of €618.6 million).

LVM has stated it will not pay any ransom and that all files have backups. The cybersecurity institution “Cert.lv” reported that the attack was carried out by a foreign financially motivated ransomware group that has also targeted other companies and government institutions.

In an interview with LTV’s “Panorāma,” Strazdiņš revealed that the hacker exploited a software vulnerability that had not been updated for seven years, starting with the “GEO” system, which had a two-year-old vulnerability. The attacker also left malware and deleted backup copies. LVM’s IT team is gradually restoring systems, including the “LVM GEO” and “Mednis” applications.

Baiba Kaškina, head of “Cert.lv,” assessed the attack as commercially motivated, adding that the hacker boasted about the intrusion on a forum. LVM has filed a report with the police, who have opened a criminal case regarding the hacker attack.