On October 16, 2023, several hundred Latvian educational institutions received violent threat emails in a coordinated cyberattack also affecting Estonia, Lithuania, and Poland.

Cyber & Information WarfareCyber AttacksHacking, malware, ransomware

AggressorDefense

Summary

During the night to October 16, 2023, more than 300 schools, pre-schools, and learning centers across Latvia received violent threat emails, marking a continuation and escalation from similar messages sent the prior week. The State Police assessed the threats as low risk but confirmed their violent content. Interior Minister Rihards Kozlovskis highlighted the campaign's goal to destabilize society and create anxiety within a hybrid warfare context. The cyberattack extended beyond Latvia to Estonia and Lithuania, targeting similar institutions along with airports and courts, with some predictions of spread to Poland. State Police Chief Armands Ruks described these as coordinated cyberattacks across the Baltic states. Authorities continue collaboration to address this offensive, urging calm and warning that the threats seek to disrupt normal life deliberately.

Classification

Confidence: High

Clear attribution of hostile coordinated cyber threat emailing campaign against Latvian and regional educational institutions indicates aggressor activity. The active response and cooperation among Latvian, Estonian, and Lithuanian security services to evaluate, assess risk, and provide guidance constitutes defense preparation.

Source URL

https://eng.lsm.lv/article/society/education/16.10.2023-more-threat-e-mails-received-by-latvias-schools-monday.a527885

Open source

Provenance

Publisher: csv-import
Submitted: Feb 1, 2026, 00:14 UTC
Last updated: Nov 8, 2026, 22:20 UTC
Event time: Oct 15, 2023, 22:40 UTC

Published as a Defense Preparations signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "af841aae-7364-4708-84db-dc0116897295",
  "url": "https://eng.lsm.lv/article/society/education/16.10.2023-more-threat-e-mails-received-by-latvias-schools-monday.a527885",
  "source": "csv-import",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Hacking, malware, ransomware",
  "country": "Latvia",
  "source_reliability": "C",
  "info_credibility": "3",
  "tags": [
    "Threat emails",
    "Cyber attack",
    "Latvia",
    "Education sector",
    "Hybrid war",
    "baltic sea region",
    "offensive cyber operations",
    "State Police",
    "Interior Minister",
    "Estonia",
    "Lithuania",
    "Poland"
  ],
  "nodes": [],
  "countries": [],
  "where_text": "Cyberspace",
  "headline": null,
  "description": "In the early hours of October 16, 2023, Latvian schools, kindergartens, and learning centers received hundreds of violent threat emails, similar but slightly altered from attacks a week earlier. Over 300 addresses were targeted initially, with a second wave sent around 6:00 AM from a different email address using the same text. Similar threats were reported in Estonia and Lithuania over the weekend, targeting educational institutions, airports, and courts, with expectations of spread to Poland. Interior Minister Kozlovskis and State Police Chief Ruks confirmed the threat level is low but serious, emphasizing the deliberate intent to destabilize and create fear as part of hybrid warfare targeting the Baltics. Police continue close cooperation with regional counterparts to manage the situation. The public is cautioned not to give in to fear despite the sustained cyber campaign.",
  "summary_short": "On October 16, 2023, several hundred Latvian educational institutions received violent threat emails in a coordinated cyberattack also affecting Estonia, Lithuania, and Poland.",
  "summary_extended": "During the night to October 16, 2023, more than 300 schools, pre-schools, and learning centers across Latvia received violent threat emails, marking a continuation and escalation from similar messages sent the prior week. The State Police assessed the threats as low risk but confirmed their violent content. Interior Minister Rihards Kozlovskis highlighted the campaign's goal to destabilize society and create anxiety within a hybrid warfare context. The cyberattack extended beyond Latvia to Estonia and Lithuania, targeting similar institutions along with airports and courts, with some predictions of spread to Poland. State Police Chief Armands Ruks described these as coordinated cyberattacks across the Baltic states. Authorities continue collaboration to address this offensive, urging calm and warning that the threats seek to disrupt normal life deliberately.",
  "actor_primary": "Unknown perpetrators of coordinated threat emails (suspected hostile cyber actors)",
  "target_primary": null,
  "location_text": "Schools, pre-schools, and learning centers across Latvia",
  "location_region": null,
  "location_coordinates_lat": null,
  "location_coordinates_lon": null,
  "location_precision": "Unknown",
  "is_aggressor_signal": true,
  "signal_type": "DEFENSE_PREP_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "Clear attribution of hostile coordinated cyber threat emailing campaign against Latvian and regional educational institutions indicates aggressor activity. The active response and cooperation among Latvian, Estonian, and Lithuanian security services to evaluate, assess risk, and provide guidance constitutes defense preparation.",
  "event_time_utc": "2023-10-15T22:40:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "exact",
  "created_at": "2026-02-01T00:14:43.752Z",
  "updated_at": "2026-11-08T22:20:37.255Z",
  "reliability_band": "strong",
  "location_precision_band": "unknown",
  "time_precision_band": "exact",
  "severity_band": "moderate",
  "attribution_confidence_band": "low",
  "attribution_basis": "single_source"
}

Public assessmentReliability: StrongSeverity: ModerateAttribution: LowSingle sourceTime: ExactLocation: Unknown

Source reliability

Info credibility

Event time

Oct 15, 2023, 22:40 UTC

Event time confidence

exact

Location

Schools, pre-schools, and learning centers across Latvia

Primary actor

Unknown perpetrators of coordinated threat emails (suspected hostile cyber actors)

Country

Latvia

Tags

Threat emails, Cyber attack, Latvia, Education sector, Hybrid war, baltic sea region, offensive cyber operations, State Police, Interior Minister, Estonia, Lithuania, Poland

Loading signal...

{ "id": "af841aae-7364-4708-84db-dc0116897295", "url": "https://eng.lsm.lv/article/society/education/16.10.2023-more-threat-e-mails-received-by-latvias-schools-monday.a527885", "source": "csv-import", "status": "approved", "category": "Cyber & Information Warfare", "subcategory": "Cyber Attacks", "incident_type": "Hacking, malware, ransomware", "country": "Latvia", "source_reliability": "C", "info_credibility": "3", "tags": [ "Threat emails", "Cyber attack", "Latvia", "Education sector", "Hybrid war", "baltic sea region", "offensive cyber operations", "State Police", "Interior Minister", "Estonia", "Lithuania", "Poland" ], "nodes": [], "countries": [], "where_text": "Cyberspace", "headline": null, "description": "In the early hours of October 16, 2023, Latvian schools, kindergartens, and learning centers received hundreds of violent threat emails, similar but slightly altered from attacks a week earlier. Over 300 addresses were targeted initially, with a second wave sent around 6:00 AM from a different email address using the same text. Similar threats were reported in Estonia and Lithuania over the weekend, targeting educational institutions, airports, and courts, with expectations of spread to Poland. Interior Minister Kozlovskis and State Police Chief Ruks confirmed the threat level is low but serious, emphasizing the deliberate intent to destabilize and create fear as part of hybrid warfare targeting the Baltics. Police continue close cooperation with regional counterparts to manage the situation. The public is cautioned not to give in to fear despite the sustained cyber campaign.", "summary_short": "On October 16, 2023, several hundred Latvian educational institutions received violent threat emails in a coordinated cyberattack also affecting Estonia, Lithuania, and Poland.", "summary_extended": "During the night to October 16, 2023, more than 300 schools, pre-schools, and learning centers across Latvia received violent threat emails, marking a continuation and escalation from similar messages sent the prior week. The State Police assessed the threats as low risk but confirmed their violent content. Interior Minister Rihards Kozlovskis highlighted the campaign's goal to destabilize society and create anxiety within a hybrid warfare context. The cyberattack extended beyond Latvia to Estonia and Lithuania, targeting similar institutions along with airports and courts, with some predictions of spread to Poland. State Police Chief Armands Ruks described these as coordinated cyberattacks across the Baltic states. Authorities continue collaboration to address this offensive, urging calm and warning that the threats seek to disrupt normal life deliberately.", "actor_primary": "Unknown perpetrators of coordinated threat emails (suspected hostile cyber actors)", "target_primary": null, "location_text": "Schools, pre-schools, and learning centers across Latvia", "location_region": null, "location_coordinates_lat": null, "location_coordinates_lon": null, "location_precision": "Unknown", "is_aggressor_signal": true, "signal_type": "DEFENSE_PREP_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "Clear attribution of hostile coordinated cyber threat emailing campaign against Latvian and regional educational institutions indicates aggressor activity. The active response and cooperation among Latvian, Estonian, and Lithuanian security services to evaluate, assess risk, and provide guidance constitutes defense preparation.", "event_time_utc": "2023-10-15T22:40:00.000Z", "end_time_utc": null, "event_time_confidence": "exact", "created_at": "2026-02-01T00:14:43.752Z", "updated_at": "2026-11-08T22:20:37.255Z", "reliability_band": "strong", "location_precision_band": "unknown", "time_precision_band": "exact", "severity_band": "moderate", "attribution_confidence_band": "low", "attribution_basis": "single_source" }