Petrošius urges probe into Lithuanian travellers’ data leak

Lithuanian MP and Conservative Audrius Petrošius has asked law enforcement and data security authorities to investigate reports that personal data belonging to Lithuanian travellers was found on a Russian black market, LRT reports.

Petrošius appealed to the Prosecutor General’s Office to assess whether to open a pre-trial investigation. He also asked the State Data Protection Inspectorate and the National Cyber Security Centre to assess possible threats to national security.

He said he was concerned that travel operator Tez Tour had used information systems in Russia and Belarus. The exposed data could include passport numbers and copies, personal identification numbers and travel destinations, he said, warning that the information could be accessible to hostile intelligence services.

Petrošius also called for an inquiry into why the company used IT infrastructure in Russia and Belarus and whether it complied with the European Union’s General Data Protection Regulation. He criticised the company’s communication with partners and customers, saying Lithuanian travel agencies had not been informed about an incident that occurred in mid-September, despite the company having launched an internal investigation.

Under the regulation, Petrošius said, a data controller must notify the supervisory authority without undue delay and, where possible, within 72 hours of a personal data breach. If the breach poses a high risk to people’s rights and freedoms, those affected must also be informed without delay.

LRT reports that a Delfi investigation published on Wednesday found personal data on a Russian black-market platform, including names, dates of birth, phone numbers, passport details and information about trips taken between 2012 and 2026. The records reportedly referenced Tez Tour, travel operator Join Up and travel agencies that work with them.

In mid-September, the hacking group DataSuckers claimed responsibility for breaking into Tez Tour systems in Russia and Belarus. Reports said about 395.5 million records, including booking, travel order and financial transaction data, had been downloaded and destroyed.

Tez Tour has said it launched an internal investigation into a possible data security breach and would cooperate with the relevant authorities. The State Data Protection Inspectorate has also begun an assessment to determine whether technical evidence shows that Lithuanian residents’ data may have been affected in Tez Tour’s infrastructure.