CSDD receives 2,500 compensation claims after data breach

Latvia’s Road Traffic Safety Directorate has received approximately 2,500 compensation requests linked to a cyber incident and leaked data, with most claimants seeking about 10,000 euros, LSM reported, citing the LETA news agency.

CSDD Communications Department head Mārtiņš Mālmeisters said the requests had been sent to various email addresses, and that the agency had responded to each one individually. CSDD has also received approximately the same number of official applications signed electronically.

The investigation into the cyberattack is continuing. Mālmeisters said the decisive factor in compensation claims related to the acquisition of personal data from CSDD’s information technology system would be a decision by the State Data Inspectorate establishing whether CSDD had failed to comply with the requirements of the General Data Protection Regulation.

Under the regulation, an individual may receive compensation if CSDD is found to have failed to fulfil its legal obligations and the breach caused harm to that person.

Mālmeisters said it was currently premature to submit compensation claims and that customers would be informed about the next steps. CSDD is also continuing to assess additional measures that could reduce potential harm.

Background

In the first half of August, hackers gained unauthorised access to the personal data of 1.2 million people and the registration numbers of approximately 150,000 legal entities through a cyberattack on CSDD’s information technology system. The data came from payments made to the directorate over the previous 18 years.

Latvia’s cyber incident prevention institution Cert.lv said the attack exploited a vulnerability in an internet-accessible CSDD system. Several mandatory cybersecurity requirements had also not been followed, and the incident was reported late.

State Police have launched criminal proceedings over the cyberattack. The Crisis Management Centre of the State Chancellery, working with Cert.lv, has been tasked with creating a working group to address the consequences of the CSDD cyber incident. The Prosecutor General’s Office will also investigate the responsibility of CSDD officials.

The entire CSDD management resigned following the incident. An interim council led by Ģirts Ozols, chair of the board of the Latvian State Radio and Television Centre, and an interim CSDD board have been appointed.