Loading story…
Latvian police arrested an unnamed 23-year-old man suspected of breaching at least two companies, stealing personal information and attempting to extort the victims. Investigators allege that he exploited website vulnerabilities to access corporate databases, exfiltrated data, and used anonymous email accounts to demand payment in exchange for not disclosing the theft.
One confirmed victim was TSC, an electronics-repair company within the LMT telecommunications group. Attackers accessed TSC's database of customer repair requests in early September; police said a similar intrusion had been detected in February. A search of the suspect's Riga home uncovered evidence of possible additional attacks against businesses in Latvia and abroad, which remain under investigation.
See the reporting duties and controls this puts on the clock.
3 events from the most recent confirmed update back to the earliest known activity.
Latvian police arrested an unnamed 23-year-old man and designated him a suspect in two company-hacking cases. A search of his Riga home found evidence of possible additional attacks against businesses in Latvia and abroad, which remain under investigation.
A similar attack targeted TSC, an electronics-repair company in the LMT group, after attackers allegedly exploited a website vulnerability to access its customer repair-request database. Potentially exposed data included customer contact details, device passcodes, bank-account numbers, addresses, and building access codes; TSC said other LMT companies and its telecommunications network were not affected.
Authorities detected an intrusion affecting one of at least two companies allegedly targeted by the suspect. Investigators said personal information was stolen and victims were subjected to attempted extortion.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Latvia’s Road Traffic Safety Directorate (**CSDD**) confirmed that attackers stole historical payment receipt data affecting more than **1.2 million people** and **200,000 businesses and legal entities**, making it one of the country’s largest reported public-sector data breaches. Exposed records reportedly included personal or company identification numbers, vehicle license plate numbers, payment amounts and dates, names, and some registered address information tied to service interactions, while officials said usernames, passwords, phone numbers, and email addresses were not compromised. Latvian authorities said the intrusion was a targeted, technically sophisticated attack that exploited an internet-exposed vulnerability in a CSDD system, and CERT.LV indicated mandatory cybersecurity requirements had not been fully met. The breach prompted criminal proceedings, investigations by cybersecurity and data protection authorities, and sharp political fallout: President Edgars Rinkevics and lawmakers called for accountability, CSDD’s supervisory board resigned, and agency chief Aivars Aksenoks said he would step down after response work concludes. Prime Minister Andris Kulbergs described the incident as a national security issue, said foreign involvement could not be ruled out, and criticized delays in notifying the government.
Aug 20, 2026
U.K. police arrested seven people aged 16 to 21 over suspected links to **Lapsus$**, the extortion-focused hacking group tied to intrusions at **Microsoft, Nvidia, Samsung, Ubisoft, Okta,** and other major firms. Reporting identified a 16-year-old near Oxford as a suspected central figure, while investigators and journalists described the group as a loose set of mostly young operators who stole data, leaked source code and internal documents, and taunted victims publicly on Telegram and other platforms. Microsoft confirmed the group obtained source code through **limited access**, reinforcing the scale and credibility of the campaign. The activity continued to expand as **Globant** disclosed unauthorized access to a limited portion of its code repository after Lapsus$ leaked **70GB** of allegedly stolen data. The company said the exposed material appeared limited to certain source code and project documentation for a small number of clients, and that it had not found evidence of broader compromise. Coverage of the group highlighted that its operators often relied on comparatively simple but highly effective tactics—including **social engineering, SIM swapping, MFA fatigue attacks,** and attempts to bribe insiders—showing how basic intrusion methods enabled a string of high-profile breaches and data leaks.
Jun 29, 2026
Tata Consultancy Services (TCS) is investigating claims that a threat actor is offering more than 800,000 employee records for sale and alleging the data was taken from a TCS Azure tenant using compromised credentials. TCS said it received threat-intelligence alerts about possible exposure of internal employee information and engaged external cybersecurity specialists to review the matter. The company said it has found no credible evidence of a breach of TCS systems or customer environments, and that the exposed information appears to be more than four years old and limited to basic employee data. TCS also disputed the attacker’s claims of using password spraying and MFA fatigue, saying protections against those techniques have been in place for over two years, while independent reporting noted there is still no public proof of an Azure compromise or validation of the full dataset being advertised.
Aug 16, 2026