Criminal Proceedings Initiated Against Cybersecurity Expert Elvis Strazdiņš

Criminal proceedings have been initiated against Elvis Strazdiņš, a well-known software engineer and cybersecurity expert, as he announced on social media. The case stems from Strazdiņš's detailed public analysis of a ransomware attack on the servers of Latvijas valsts meži (LVM), the state forest company.

Strazdiņš had published chat logs with the hacker, who demanded a ransom of 0.1% of LVM's annual revenue. According to LVM's 2025 report, revenue was €618.6 million, making the ransom approximately €618,600. LVM stated it would not pay any ransom and that all files have backups.

The attack was claimed by a foreign financially motivated ransomware group, which has targeted other companies and institutions worldwide. Strazdiņš noted that the hacker exploited a seven-year-old software vulnerability; one server had not been updated with the latest patch. The hacker also used other older vulnerabilities, including one from 2019, and left malware on the servers. Backup copies were deleted.

LVM is gradually restoring its IT systems. Some internal systems are already operational, but external systems such as "LVM GEO" and the hunting app "Mednis" remain offline for security reasons. According to Baiba Kaškina, head of Cert.lv, the attack appears commercially motivated, and the attacker has been relatively open, describing his activities on a hacker forum.