Latvia road traffic agency CSDD breached; personal ID codes, plates and addresses of about two-thirds of the population stolen

Latvia's CERT.LV said the Road Traffic Safety Directorate (CSDD) confirmed an attacker obtained data from payment receipts dating back to 2008 between August 8 and 10, affecting 1.2 million people and 200,000 legal entities ^[1]. According to The Record, the data includes personal ID or company registration numbers, names, payment amounts and dates, plates and vehicle registration addresses, but not phones, emails or credentials; CERT.LV said attackers exploited a vulnerability in an internet-facing CSDD system and several mandatory security requirements were unmet ^[2]. Residents should be wary of messages, emails or calls claiming to be from CSDD or other agencies, avoid opening their links, and verify on e.csdd.lv or the CSDD app ^[1].

Industries mainly affected: Government, Transportation & logistics

1. Be wary of messages, emails and calls claiming to be from CSDD or other agencies ^[1].
2. Do not open links in such messages; verify on e.csdd.lv or the CSDD app .