Cyberattack exposes data of 1.2 million CSDD clients

A cyberattack on Latvia’s Road Traffic Safety Directorate, known as CSDD, obtained personal data belonging to 1.2 million people, LSM reported, citing the agency.

The attacker accessed information contained in payment receipts dating back to 2008. The data included a personal identification number or company registration number, a person’s name and surname or a company name, the payment amount and date, a vehicle’s registration number, and the address registered when the service was received.

CSDD Information Technology Department head Māris Puriņš said clients’ contact information, including telephone numbers and email addresses, had not been affected. He added that the address information obtained was incomplete in some cases.

CSDD is continuing to investigate the attack. The agency has restricted unauthorised users’ ability to obtain information about a vehicle’s make and model using its registration number and is cooperating with the relevant authorities to identify the attacker.

Puriņš said CSDD had also faced a targeted cyberattack over the weekend, but security improvements had enabled the agency to block it.

Varis Teivāns, deputy head of CERT.lv, said the main risk posed by the leaked data was that it could be used in future social engineering and fraud campaigns. Names, personal identification numbers, vehicle registration numbers, addresses and information about previous payments could allow scammers to create more convincing and personalised text messages, emails and phone calls.

Residents have been urged to pay attention not only to the content of messages but also to their language and spelling, particularly the way names, addresses and other details are written. They have also been advised not to open links in received messages or emails, and to check current information about CSDD communications on e.csdd.lv or in the CSDD mobile app.

CSDD said it had informed the Data State Inspectorate about the cyberattack.