People seek compensation after CSDD data breach

About 2,000 submissions related to the cyberattack on Latvia’s Road Traffic Safety Directorate, or CSDD, and the resulting data breach have been received, including compensation claims, LSM reports. Templates for such claims have also been circulated on social media.

CSDD is urging people not to rush to seek compensation and to wait for the results of the State Data Inspectorate’s investigation. So far, few people have used options available after the incident to replace items such as vehicle registration plates.

Lawyer seeks 10,000 euros

Sworn advocate Lauris Klaišs is seeking 10,000 euros from CSDD after his personal data was obtained by the attackers. The leaked information included his exact home address.

Klaišs said concerns about his family’s safety had prompted him to seek compensation for non-material damage.

“I live in my house, which I do not plan to sell in the near or distant future. Most likely, I will live here for a very long time. My family lives with me. So this concern about our physical safety is what prompted me to take action against CSDD, effectively against the state, because the state did not ensure the protection of my data and must bear some responsibility for that,” Klaišs said.

Klaišs has published a template for his submission online free of charge, saying he does not plan to make money from the case. CSDD has warned people against paid offers to prepare compensation claims and advised them not to use such services.

The directorate has received around 1,400 submissions related to the cyberincident. However, it is asking people to wait for the State Data Inspectorate’s investigation before submitting compensation claims.

“These submissions are being reviewed. Of course, we respond to every submission, whether it is electronically signed or simply sent by email. But we really ask people not to submit them at this point, because for now there is no basis for any further action on our part,” said CSDD representative Mārtiņš Mālmeisters.

Investigation may take several months

It is not yet known how long people will have to wait. The State Data Inspectorate said that, in practice, high-priority cases are usually examined within four to nine months.

The inspectorate does not award compensation. If a dispute over compensation arises, it must be resolved in court.

Klaišs, however, believes that people do not need to wait until the inspectorate’s investigation is complete before seeking compensation.