Latvia’s Road Traffic Safety Directorate (CSDD) has confirmed that hackers stole data belonging to more than 1.2 million people and 200,000 businesses — roughly two-thirds of Latvia’s entire population of 1.8 million. The stolen records come from payment receipts dating back to 2008 and include personal identification numbers, vehicle license plate numbers, payment amounts and dates, and addresses listed on vehicle registration certificates. Phone numbers, email addresses, usernames, and passwords were not affected, the agency said.
CERT.LV, Latvia’s computer emergency response team, described the attack as “complex” and “targeted,” noting that significant preparation preceded it. Investigators said the hackers exploited a vulnerability in a CSDD internet-facing system and that several mandatory cybersecurity requirements had not been in place. The agency has since restricted access to its public license plate lookup service and reported blocking a follow-up attack over the weekend. The incident has escalated into a political controversy: Latvia’s president called the breach a “significant threat to national security” and demanded that CSDD leadership step down. By Wednesday, the agency’s supervisory board had submitted its resignation and the director was preparing to follow. CERT.LV warned that the stolen combination of identification numbers, plate numbers, and addresses gives fraudsters a rich toolkit for social engineering and impersonation schemes.