Strazdins warns: CSDD data leak consequences may surface only later

After it emerged that hackers had breached the information system of Latvia's Road Traffic Safety Directorate (CSDD), partially accessing historical payment receipt data, anti-fraud activist Elviss Strazdins warned on social media that the story may not be over.

The leaked information reportedly included personal data such as names, company names, personal identity or registration numbers, payment details, payment dates, vehicle registration plates and addresses.

Scammers may wait

Strazdins stressed that not receiving a suspicious call or message immediately after the breach does not mean the data won't be misused later. He said fraudsters could launch their campaigns after a longer delay, for example by sending an email or text message about a supposedly unpaid bill or fine linked to CSDD.

According to Strazdins, the leaked data itself could make such fraudulent messages far more convincing — if a scammer already knows a person's name and vehicle registration plate, the recipient may find it harder to immediately recognize the message as fake. He urged people to pay close attention to web addresses included in messages asking them to click through, and to be cautious with suspicious texts, emails and phone calls.

Official guidance

Both CSDD and Latvia's cyber incident response institution CERT.LV are advising residents to verify any received messages by independently opening the official e-CSDD website rather than clicking links included in the messages. CERT.LV deputy head Varis Teivans had earlier noted that data obtained in the incident could be used for targeted fraud attempts.

CERT.LV also pointed out that the CSDD name has long been used in phishing campaigns in Latvia, giving residents an additional reason to remain cautious following this incident.