CSDD leadership resigns after cyberattack exposes 1.2 million people’s data

The entire leadership of Latvia’s Road Traffic Safety Directorate, known as CSDD, resigned on Wednesday after a cyberattack exposed data belonging to about 1.2 million people and 150,000 legal entities, LSM reported.

The attack on CSDD’s information technology systems took place from August 8 to 10. The affected data covers the period since 2008. CSDD said customer usernames and passwords were not compromised.

The directorate’s council resigned first, followed by its board led by Aivars Aksenoks. Latvia’s Prosecutor General’s Office, the Data State Inspectorate and the Transport Ministry have launched or ordered investigations into the data breach, its circumstances and its consequences.

The investigations will also examine CSDD’s contract with telecommunications and technology company Tet for cybersecurity services. Transport Minister Talis Linkaits said CSDD pays a significant monthly amount for the services. Information in the Electronic Procurement System shows that the initial value of CSDD’s contract with Tet for maintaining and managing the information technology infrastructure of the national vehicle and driver register was nearly 9 million euros excluding value-added tax.

Tet said the CSDD systems are maintained under the contract by Kyndryl, one of the world’s leading IT services companies, which acts as Tet’s subcontractor. Economy Minister Viktors Valainis said the breach did not occur through the CSDD systems protected by Tet. Tet has not denied responsibility for what happened.

CSDD customers have the right to contact the institution to ask whether their personal data was affected by the cyberattack and what they should do.

CSDD has also published a notice in its mobile application urging residents to be cautious with messages that appear to have been sent on behalf of CSDD or another institution.