Security incident detected in Latvia's consumer rights authority IT system
A cybersecurity incident has been found in a system used by Latvia's Consumer Rights Protection Centre, exposing contact details of hundreds of business representatives and staff. The affected system has since been shut down.
Latvia's Consumer Rights Protection Centre (PTAC) has identified a data security incident in one of its information systems used to oversee licensed businesses. The affected system, known as ASDIS (Remote Statistical Data Extraction System), is classified at the lowest risk level, level C, and meets the country's minimum cybersecurity requirements.
ASDIS operates within network infrastructure equipped with an early-warning sensor system run by Cert.lv, the national body responsible for preventing cyber incidents, which is how the breach was detected.
What data was accessed
An ongoing investigation indicates that the incident resulted in access to contact information of PTAC-licensed entities — providers of consumer credit services, out-of-court debt recovery services, and package travel services. In total, contact details of 697 business representatives and 34 PTAC officials were extracted, including names, surnames, email addresses and phone numbers. PTAC notes that most of this information is already publicly available in other registries, such as the Open Data Portal. The agency confirmed that supervisory data submitted to PTAC by businesses was not compromised in the incident.
Next steps
The affected system is currently shut down, and PTAC has informed all its users about the unavailability. The agency stressed that, given the unstable geopolitical situation, it is essential to strengthen the security of technological resources and secure the necessary funding for this purpose — a need previously raised by the Ministry of Economics during a Cabinet of Ministers session on cybersecurity issues.
