Data security incident at Latvia's consumer rights agency exposes hundreds of contacts

Latvia's Consumer Rights Protection Centre (PTAC) has reported a data security incident in one of its information systems, the agency told LETA. The breach exposed contact information for hundreds of people, including names, email addresses and phone numbers.

The affected system

The compromised system is the Remote Statistical Data Retrieval System (ASDIS), which PTAC uses to supervise licensed businesses. It is classified as a Class C system — the lowest risk category for information systems — and meets the country's minimum cybersecurity requirements. ASDIS operates within a network infrastructure equipped with an early-warning sensor system run by Cert.lv, Latvia's cyber incident response institution.

What was accessed

According to the ongoing investigation, the exposed contacts belong to representatives of businesses licensed by PTAC — providers of consumer credit services, out-of-court debt recovery services, and package travel services. In total, contact details of 697 business representatives and 34 PTAC officials were obtained, including full names, email addresses and phone numbers. PTAC noted that most of this information is also available in other public registers, such as the Open Data Portal, and that the incident did not compromise supervisory data submitted by companies to the agency.

Response

The affected system has been shut down, and all its users have been notified of its unavailability. PTAC stated that, given the current unstable geopolitical situation, it is essential to strengthen the security of technological resources and allocate the necessary funding for this purpose — a need previously raised by the Ministry of Economics during a Cabinet of Ministers meeting on cybersecurity.