Lithuanian intelligence chief says stolen registry data misuse depends on “adversary’s imagination”

The head of Lithuania’s State Security Department (VSD) has declined to confirm whether the recent mass theft of citizen data from the country’s Centre of Registers (RC) was a coordinated attack by a hostile state, stating that potential misuse of the leaked information would depend on “the adversary’s imagination.”

Speaking to journalists in parliament on Friday, VSD director Remigijus Bridikis avoided endorsing President Gitanas Nausėda’s earlier suggestion that the breach could be part of a hostile foreign operation. Bridikis stressed that such claims would require confirmation through a pre-trial investigation led by prosecutors.

“I’m not sure if I can say that, or if I can support our [state] leader on this. This would fall under the prerogative of the pre-trial investigation and the prosecutor’s office—to determine this based on the evidence uncovered or decisions made during the investigation,” Bridikis said.

He acknowledged the sensitivity of the stolen data, which includes extensive personal and legal records, but noted that the ways it could be exploited would vary. “The volume of data is large, and the data is sensitive. There’s a lot of information about legal entities, third parties, and other details. What combinations of this data could be used, and in what context—that’s a question of the adversary’s imagination,” he said.

The Prosecutor General’s Office launched a pre-trial investigation on Thursday into the theft, which may have involved over 600,000 property registry extracts, with estimated damages exceeding €111,000. The incident was first reported to authorities on April 15, but the public was not informed until this week, sparking criticism of delayed transparency.

Prime Minister Ingrida Šimonytė had previously stated that disclosure was restricted due to the ongoing prosecution-led probe, warning that premature release of details could obstruct the investigation. However, President Nausėda disputed this, insisting there had been no legal prohibition on public notification.

Addressing concerns about the security of intelligence personnel in light of the breach, Bridikis assured that the VSD has measures in place to protect its officers but declined to specify them. “We do [have measures], but I can’t disclose them—our law requires us to take steps to safeguard our information and activities. If we reveal what we’re protecting, the adversary will know our weak points,” he explained.

He added that the focus should remain on institutional safeguards rather than public anxiety. “I don’t think the public needs to worry. It’s our responsibility—as leaders—to ensure protection. My job is to find ways to do that,” Bridikis said.