Lithuanian president says cyberattack on registry centre shows signs of hostile state involvement

Lithuanian President Gitanas Nausėda stated on Wednesday that a recent data breach at the country’s Centre of Registers bears signs of a cyberattack orchestrated by hostile states, LRT.lt reports.

Speaking after a meeting of the State Defence Council, Nausėda confirmed that the initial breach occurred through compromised Migration Department accounts but warned that other vulnerabilities remain. He stressed that Lithuania must be better prepared for similar cyber threats in the future.

“Today, we can likely assert that this was an action by hostile states. There are indications that this cyberattack was organised by hostile states,” the president said.

He criticised the delayed response by state institutions, calling the handling of the incident “unacceptable.” Nausėda emphasised that real-time alerts should have been triggered as soon as the data security risk was identified, rather than leaving the public uninformed for an extended period.

“The notification was unsatisfactory. When a data security issue is detected, all signals and red lights must go off immediately. People cannot be kept in the dark indefinitely,” he said.

The president also revealed he had not been informed in real time about the breach, despite repeated assurances from officials. Authorities initially claimed the incidents were isolated and not part of a larger pattern, but Nausėda dismissed this justification, noting that even recurring incidents should have prompted swifter action.

Another explanation provided to the president was that officials first wanted to develop a tool allowing citizens to check if their data had been compromised—a process that took “three weeks or more,” which Nausėda called “no excuse.”

He described the breach as a scandal that “undermines the foundations of national security” and stressed that institutional accountability remains critical, regardless of foreign involvement.

The Centre of Registers, a state agency managing Lithuania’s official databases, reported in May that personal data—including names, addresses, and property records—had been accessed without authorisation. Investigations are ongoing.