CSDD cyberattack compromises data of 1.2 million people in Latvia

CSDD cyberattack data breach Latvia Tet telecommunications personal data theft IT security failure

A major cyberattack on Latvia's Road Traffic Safety Directorate (CSDD) has resulted in the theft of personal data belonging to 1.2 million individuals and approximately 200,000 legal entities. The breach involved payment records spanning the last 18 years.

Investigations have clarified the scope of responsibility. Economy Minister Viktors Valainis stated that the attack targeted a CSDD-managed application that fell outside the cyber supervision scope of the telecommunications company Tet, which holds a multi-million euro contract for CSDD's network and infrastructure. Prime Minister Andris Kulbergs noted that the 'Medical' platform used by approximately 200 doctors was vulnerable because it relied on simple username and password authentication rather than multi-factor authentication.

The incident has sparked political tension and allegations of negligence. Prime Minister Kulbergs raised concerns about a potential conflict of interest involving an individual employed by both CSDD and its service provider. Meanwhile, former CSDD board chairman Aivars Aksenoks has defended the agency, placing blame on Tet for failing to detect the intrusion. President Edgars Rinkēvičs has indicated that CSDD leadership should not continue in their roles following the breach.

Entities

Aivars Aksenoks · Andris Kulbergs · CSDD · Cert. lv · Latvian Television · Tet · Viktors Valainis

Claims

What the coverage asserts, and how many sources carry each claim.

[● 2 SOURCES] The breach resulted in the theft of personal data belonging to 1.2 million individuals and data for approximately 200,000 legal entities. pmo.ee · nra.lv
[○ 1 SOURCE] The cyberattack targeted an application managed by CSDD that was outside the scope of Tet's contractual supervision. pmo.ee
[● 2 SOURCES] The 2022 contract between CSDD and Tet for IT infrastructure and management was valued at approximately 8.989 million euros excluding VAT. pmo.ee · nra.lv
[● 2 SOURCES] The stolen data included payment records spanning the last 18 years. pmo.ee · nra.lv
[● 2 SOURCES] The CSDD 'Medical' platform lacked multi-factor authentication, relying only on usernames and passwords. pmo.ee
[○ 1 SOURCE] Prime Minister Andris Kulbergs raised concerns regarding a potential conflict of interest involving an individual working for both CSDD and its service provider. pmo.ee

Sources

Kiberuzbrukums CSDD noticis caur pašas iestādes pārziņā esošu lietotni [pmo.ee]

1 day ago

Premjers pauž bažas par iespējamu interešu konfliktu CSDD kiberdrošības uzraudzībā [pmo.ee]

2 days ago

Iezīmējas skaidrība CSDD datu zādzības jautājumā [nra.lv]

about 2 hours ago