On the night of August 7-8, 2026, an attacker infiltrated the Latvian Road Traffic Safety Directorate (CSDD) systems via the CSDD 'Medical' platform used by about 200 doctors for medical certification. Exploiting multiple vulnerabilities and lack of proper penetration testing and authentication, the hacker accessed a database containing payment and personal data, stealing information on 1.2 million physical persons and 200,000 legal entities. This is the second largest data breach in Latvia's history. Analysis by Cert.lv suggests the hacker likely also attempted to access other state systems. The intrusion went unnoticed at the time, with no alerts triggered. CSDD only notified Cert.lv on the evening of August 10, and reporting to the Data State Inspectorate (DVI) was delayed beyond the legally mandated 72 hours. The State Police launched an investigation on their own initiative and are monitoring for stolen data resurfacing on dark markets. The CSDD management resigned under political pressure, and interim governance was appointed. Cert.lv had offered cyber incident detection services to CSDD earlier in the year, which were declined. The contracted IT service provider 'Tet' was not responsible for the compromised platform and did not detect the attack due to its complexity and limitations in their monitoring scope. The breach exposes individuals to targeted fraud and other risks.

On the night of August 7-8, 2026, an attacker infiltrated the Latvian Road Traffic Safety Directorate (CSDD) systems via the CSDD 'Medical' platform used by about 200 doctors for medical certification. Exploiting multiple vulnerabilities and lack of proper penetration testing and authentication, the hacker accessed a database containing payment and personal data, stealing information on 1.2 million physical persons and 200,000 legal entities. This is the second largest data breach in Latvia's history. Analysis by Cert.lv suggests the hacker likely also attempted to access other state systems. The intrusion went unnoticed at the time, with no alerts triggered. CSDD only notified Cert.lv on the evening of August 10, and reporting to the Data State Inspectorate (DVI) was delayed beyond the legally mandated 72 hours. The State Police launched an investigation on their own initiative and are monitoring for stolen data resurfacing on dark markets. The CSDD management resigned under political pressure, and interim governance was appointed. Cert.lv had offered cyber incident detection services to CSDD earlier in the year, which were declined. The contracted IT service provider 'Tet' was not responsible for the compromised platform and did not detect the attack due to its complexity and limitations in their monitoring scope. The breach exposes individuals to targeted fraud and other risks.