CSDD explains how customers can check whether data was exposed
Wednesday 19th August 2026 on 15:15 in
Latvia
The Road Traffic Safety Directorate, known as CSDD, has told people how to find out whether their personal data was affected by a cyberattack, LSM reported. The authority said individuals have the right to request information about whether their data was compromised and which categories of data were affected.
Requests can be submitted directly to CSDD. For additional questions, people can contact the agency’s data protection specialist, Uldis Sīpols, during working hours by phone at +371 67025736 or by email at [email protected].
If personal data has been affected, individuals have the right under the General Data Protection Regulation to file a complaint with Latvia’s Data State Inspectorate at Elijas Street 17-2, Riga, LV-1050.
The analysis and assessment of the cyberattack is continuing to determine the extent of the affected data. CSDD’s IT team, working with CERT.LV, Latvia’s cyber incident response institution, has stopped the attack and made a number of improvements to the security of its IT systems.
Based on information available on August 19, the data that may have been affected includes a person’s first and last name or a company name, personal identity number or registration number, address, vehicle registration number, payment amount and payment date.
CSDD advises customers to be especially cautious about messages or calls that appear to come from CSDD or another institution. People should not open links included in such messages, should verify information on csdd.lv or in the CSDD mobile app, and should not enter or approve access codes unless they initiated the service themselves.
In early August, hackers unlawfully obtained the personal data of 1.2 million people and the registration numbers of about 150,000 legal entities in an attack on CSDD’s IT system. The data came from payments made to the directorate over the previous 18 years.
CERT.LV said the attack exploited a vulnerability in a CSDD system accessible via the internet. Several mandatory cybersecurity requirements had also not been followed, and information about the cyber incident was received late. Latvia’s State Police has launched criminal proceedings over the attack.