Loading story…
Latvia’s Road Traffic Safety Directorate (CSDD) confirmed that attackers stole historical payment receipt data affecting more than 1.2 million people and 200,000 businesses and legal entities, making it one of the country’s largest reported public-sector data breaches. Exposed records reportedly included personal or company identification numbers, vehicle license plate numbers, payment amounts and dates, names, and some registered address information tied to service interactions, while officials said usernames, passwords, phone numbers, and email addresses were not compromised.
Latvian authorities said the intrusion was a targeted, technically sophisticated attack that exploited an internet-exposed vulnerability in a CSDD system, and CERT.LV indicated mandatory cybersecurity requirements had not been fully met. The breach prompted criminal proceedings, investigations by cybersecurity and data protection authorities, and sharp political fallout: President Edgars Rinkevics and lawmakers called for accountability, CSDD’s supervisory board resigned, and agency chief Aivars Aksenoks said he would step down after response work concludes. Prime Minister Andris Kulbergs described the incident as a national security issue, said foreign involvement could not be ruled out, and criticized delays in notifying the government.
See attribution, scope, and your downstream exposure.
9 events from the most recent confirmed update back to the earliest known activity.
Prime Minister Andris Kulbergs referenced another serious cyber incident affecting the state forestry administration in June 2026, using it to highlight broader cybersecurity weaknesses in government authorities.
CSDD said the stolen historical payment receipt data dated back to 2008, establishing the earliest known period covered by the compromised records.
Latvian state police opened criminal proceedings while cybersecurity and data protection authorities continued investigating the incident and trying to identify the perpetrators.
CSDD's supervisory board submitted its resignation on Wednesday morning amid political fallout from the breach and calls for leadership accountability.
President Edgars Rinkevics said the attack posed a significant threat to national security and called for CSDD leadership to step down. Prime Minister Andris Kulbergs said a foreign origin could not be ruled out, described the breach as a national security issue, and criticized delayed notification and weak cybersecurity practices.
CSDD said it stopped another attempted cyberattack over the weekend after implementing security improvements following the initial breach.
After the breach, CSDD said it worked with cybersecurity authorities to identify and completely block the attackers' methods and channels. It also restricted access to a vehicle lookup service that allowed users to retrieve vehicle information by license plate number.
CERT.LV said the attackers exploited a vulnerability in an internet-exposed CSDD system and described the operation as targeted, prepared in advance, and technically sophisticated. CERT.LV also said several mandatory cybersecurity requirements had not been met.
CSDD first disclosed the previous week that it had suffered a complex cyberattack involving partial access to systems containing historical payment receipt data. The breach affected more than 1.2 million people and 200,000 businesses and legal entities.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcetherecord.media
Open sourcedailysabah.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Lithuanian prosecutors are investigating a major breach of the state registry systems after attackers used login credentials assigned to authorized institutions to access more than 600,000 records held by the Centre of Registers. The intrusion affected the Real Estate and Legal Entities Registers and exposed sensitive personal and property data, including names, dates of birth, national identification numbers, addresses, cadastral information, and registry numbers. Authorities said the breach was detected in early April, but disclosure was delayed while the criminal investigation proceeded, and the estimated financial damage exceeds **€111,000**. Lithuania has blocked suspected accounts and ordered credential changes as it works to contain the incident, while questions over the security of state IT systems intensified. Centre of Registers chief **Adrijus Jusas** resigned following the leak and said years of underinvestment had left government platforms in need of as much as **€60 million** in cybersecurity upgrades. Officials have not publicly attributed the attack or identified a responsible threat actor, despite political claims that the operation may show signs of foreign, possibly Russian, involvement.
Jun 29, 2026
Miljödata, a major Swedish IT systems supplier serving approximately 80% of Sweden's municipalities, suffered a significant cyberattack in August that resulted in the exposure of personal data belonging to 1.5 million individuals. The attackers, identified as the Datacarry threat operation, stole sensitive information and demanded a ransom of 1.5 Bitcoin, subsequently leaking a 224 MB archive of data on the dark web. The breach affected citizens across multiple regions, including Halland, Gotland, Skellefteå, Kalmar, Karlstad, and Mönsterås, and included data from children, protected identity subjects, and former employees. The Swedish Authority for Privacy Protection (IMY) and other state agencies, including CERT-SE and the police, launched immediate investigations into the incident, focusing on potential violations of the European Union's General Data Protection Regulation (GDPR). IMY is prioritizing its investigation on Miljödata and several municipalities, examining both the security measures in place and the handling of sensitive data. The incident has raised serious concerns about the adequacy of security controls and data management practices within Swedish public sector IT systems, prompting calls for improved safeguards to prevent similar breaches in the future.
Jun 29, 2026
France’s Ministry of the Economy and Finance confirmed a cyber intrusion into the **Direction générale des Finances publiques (DGFiP)** that exposed data linked to roughly **680,000** individuals and businesses after unauthorized access in late June 2026. Reporting indicates the compromise involved impersonation or misuse of identity and access privileges, with at least **678,437** affected records later advertised for sale on the dark web by an actor calling itself **ZeroBytes**. The exposed population reportedly included both private taxpayers and professionals, and the intrusion was detected during a routine check before access restrictions were tightened. Separate dark-web reporting tied to the same actor alleges a broader compromise of DGFiP-linked cadastral systems affecting **2,041,778** property holders, including land-registry data associating named individuals with fixed addresses and ownership information. Those claims say the attackers used valid credentials and an alleged multi-factor authentication bypass, and that they offered both the stolen data and continued access for sale, although that second breach had not been publicly verified or acknowledged by DGFiP at the time of reporting. The incident raises immediate risk of **phishing**, business email fraud, and other social-engineering attacks using tax, cadastral, and civil-status data.
Aug 20, 2026