Prime minister’s advisor defends delayed disclosure of Lithuania’s mass data breach

The office of Prime Minister Inga Ruginienė has defended the decision not to publicly disclose a large-scale data breach at Lithuania’s Centre of Registers (RC) earlier, arguing that premature communication could have compromised the pre-trial investigation, reports LRT.

Advisor Ignas Algirdas Dobrovolskas told the Baltic News Service (ELTA) that authorities received initial reports of isolated incidents in early April, prompting an immediate pre-trial investigation. “During this stage, responsible action was required to avoid harming the investigation,” he said, citing Article 247 of the Criminal Code, which prohibits unauthorised disclosure of pre-trial data.

Dobrovolskas emphasised that parallel to the investigation, measures were taken to halt unauthorised access and strengthen system security. “We understand public concerns about personal data security,” he said, adding that the Prosecutor General’s Office had provided additional clarifications on data protection aspects.

The breach, first reported by media this week, allegedly involved the leakage of over 600,000 property register records between January and April, with estimated damages exceeding €111,000. The Prosecutor General’s Office confirmed the investigation began on 15 April, the same day it received notification of the incident.

Criticism over delayed public notification has come from President Gitanas Nausėda and Economy Minister Edvinas Grikšas. While Ruginienė stated that authorities were informed in April, she maintained that public disclosure was restricted by the ongoing investigation. However, the Prosecutor General’s Office clarified on Thursday that the responsibility to inform the public lay with the Centre of Registers, not law enforcement.

Dobrovolskas concluded that current priorities include reinforcing cybersecurity, enhancing system resilience, and implementing measures to prevent future incidents.