2026 Latvia CSDD — cyberattack; 1.2M people + ~200K entities (IDs/plates/payments since 2008)
Data compromised
Personal/company IDs; names; payment amounts/dates; vehicle plates; registration addresses. CSDD: phones, emails, usernames/passwords not compromised.
Technical writeup
Latvia’s Road Traffic Safety Directorate (CSDD) confirmed on August 18, 2026 that a cyberattack over August 8–9 accessed historical payment-receipt systems, exposing data on more than 1.2 million people and about 200,000 businesses/legal entities (receipts dating to 2008). Stolen fields include personal or company registration numbers, names, payment amounts and dates, vehicle plates, and addresses from registration certificates. CSDD states phones, emails, and passwords were not taken. CERT.LV described a prepared intrusion against an internet-exposed vulnerability and warned of social-engineering risk. Leadership resignations followed; President Rinkēvičs called it a national-security threat. Services remained available; plate lookup was restricted.
Root cause
Targeted cyberattack on internet-exposed CSDD systems; historical payment-receipt data accessed (Aug 8–9, 2026)