On 22 June 2026, the Latvian state-owned company Latvijas Valsts meži (LVM) experienced a significant ransomware cyberattack exploiting an unpatched software vulnerability dating back seven years. The attacker first exploited a two-year-old vulnerability in 'GEO' software on one server where the old version was still active, followed by further exploitation of various older software vulnerabilities, including one from 2019. The hacker systematically stole about 7,000 employee passwords (some possibly outdated) and installed malware on the servers. Most critically, the attacker encrypted all data and deleted backups. The attacker publicly documented the attack steps, communicating primarily in French and English, using an Israeli phone number, indicating a probable French national on the move. The ransomware group is financially motivated and has left contact information to negotiate ransom payment, despite official claims denying ransom demands. The incident raised serious concerns about Latvia's national cybersecurity posture and delayed government implementation of cyber laws and regulations, despite dedicated funding. The Prime Minister Andris Kulbergs has demanded comprehensive information and accountability from ministries and plans a government session to address the situation. The state cybersecurity institution Cert.lv confirmed the attack was conducted by a foreign financially motivated ransomware group with a history of attacks across multiple countries. Police criminal proceedings have been initiated.

On 22 June 2026, the Latvian state-owned company Latvijas Valsts meži (LVM) experienced a significant ransomware cyberattack exploiting an unpatched software vulnerability dating back seven years. The attacker first exploited a two-year-old vulnerability in 'GEO' software on one server where the old version was still active, followed by further exploitation of various older software vulnerabilities, including one from 2019. The hacker systematically stole about 7,000 employee passwords (some possibly outdated) and installed malware on the servers. Most critically, the attacker encrypted all data and deleted backups. The attacker publicly documented the attack steps, communicating primarily in French and English, using an Israeli phone number, indicating a probable French national on the move. The ransomware group is financially motivated and has left contact information to negotiate ransom payment, despite official claims denying ransom demands. The incident raised serious concerns about Latvia's national cybersecurity posture and delayed government implementation of cyber laws and regulations, despite dedicated funding. The Prime Minister Andris Kulbergs has demanded comprehensive information and accountability from ministries and plans a government session to address the situation. The state cybersecurity institution Cert.lv confirmed the attack was conducted by a foreign financially motivated ransomware group with a history of attacks across multiple countries. Police criminal proceedings have been initiated.