Lithuanian mayor warned of data breach in February but response stalled in bureaucracy

The mayor of Neringa first reported suspicious activity in Lithuania’s Register Centre to the Interior Ministry in February, but his warning was lost in bureaucratic delays, LRT.lt reports.

Darius Jasaitis, mayor of the western resort municipality, noticed his property records were being accessed outside working hours—including late at night and on holidays. He and his wife filed a formal inquiry on February 18, only to receive a response after 20 days stating their request had been forwarded to a service provider, which never followed up.

Jasaitis told LRT.lt he had previously experienced personal data leaks during election campaigns, including an incident where a convicted bribery suspect listed all his addresses in court. This history heightened his vigilance. When he checked the Register Centre’s access logs, he found his records had been systematically reviewed and compiled into summaries—activity he deemed unusual for legitimate inquiries.

“We saw that our entire property portfolio had been extracted into reports,” Jasaitis said. “What struck us most was that this was done at midnight, half past eleven at night. Then we found out it happened on February 16, a public holiday. We thought maybe a rival or someone malicious had bought access.”

Though initially concerned, Jasaitis said his alarm eased after learning other municipal employees’ data had also been accessed, assuming it might be a routine state database update. The mass breach—affecting 600,000 records—was only publicly disclosed in late May, despite Prime Minister Ingrida Ruginienė being informed in early April and law enforcement launching an investigation mid-month.

Experts later confirmed the incident could have been prevented had Jasaitis’ February warning been acted upon promptly.