🚨 CSDD CYBERATTACK — NEGLIGENCE WITH REAL CONSEQUENCES FOR STATE SECURITY — Today about the @CSDD_LV cyberattack, its consequences, and what must be done now. The CSDD board and council have been dismissed. Temporary management will be appointed instead, while competitions for the permanent board and council are started immediately. 🔴 WHAT HAPPENED? ➖️ On August 8 at about 3:00 AM, from Friday to Saturday, an attacker broke into the CSDD system. ➖️ The breach occurred through the CSDD MEDICAL platform, which about 200 doctors use to enter medical certificates for vehicle drivers. ➖️ The attacker operated undisturbed through the system on Saturday and Sunday. ➖️ On Sunday evening, a large-scale data download occurred. ➖️ CSDD only learned of the suspicious activity on Monday. ➖️ On Wednesday, it was established that data theft had occurred. ➖️ The Prime Minister was only informed on Wednesday at 5:00 PM. ❗ HOW WAS THIS POSSIBLE AT ALL? CSDD should have had secure multi-factor authentication. But CSDD MEDICAL access was possible only with a regular username and password. CSDD had every opportunity to implement top-level cybersecurity: 💶 there were financial resources; 💻 there was IT capacity; 🧠 there were knowledge and specialists. Yet self-assurance, negligence, and arrogance toward cybersecurity risks have led to one of the most serious data leaks in state possession. It threatens not only people's privacy but also the security of citizens, businesses, and the state. 📂 WHAT DATA HAS LEAKED? A very large volume of data is concerned: ➖️ data of approximately 1.3 million private individuals; ➖️ data of approximately 200,000 companies; ➖️ payment information for the period from 2008 to 2026; ➖️ first name, surname, or company name; ➖️ personal code or company registration number; ➖️ declared address; ➖️ vehicle state registration number. I do not understand why CSDD needed to store payment data since 2008 on its servers at all, if the regulatory acts do not require such storage. 🛡️ WARNINGS WERE THERE. THEY WERE NOT USED. CSDD had a contract with TET for server and connection cybersecurity, but not for the protection of CSDD's own application and software. Moreover. https://t.co/Y2dCsXsES5 had already offered from January to April 2026 to install its sensors that automatically identify suspicious anomalies in the network. The CERT measure is free. CSDD refused it. ⚖️ A submission has been filed with the prosecutor's office for possible negligence or wrongdoing. Law enforcement authorities must now establish the responsibility of each official. ✅ WHAT DO WE DO NEXT? I have issued a Prime Minister's resolution with 12 specific tasks for ministries and state institutions. Key ones: ➖️ CSDD must inform every affected person and company, indicating what specific data has leaked. ➖️ https://t.co/Y2dCsXsES5 sensors must be mandatorily installed in all critically important state systems so that anomalies are identified in a timely manner, not several days after the breach. ➖️ All critical infrastructure and sensitive data institutions must carry out full-scale intrusion simulations, i.e., penetration tests, to really test system resilience and find weaknesses before an attacker does. ➖️ Instructed to assess the possibility of restricting the freely accessible e-CSDD vehicle number plate check tool. ➖️ Instructed to assess how quickly state systems can abandon the use of the personal code as a username, moving to a more secure identification solution. ➖️ https://t.co/Y2dCsXsES5 has submitted a list of other state institutions that similarly refused the proposed cybersecurity measures. Next week we will go through this list. And the questions will be unpleasant. ⚠️ A MUCH GREATER STATE SECURITY RISK — declarations of officials. Individually, this data is already sensitive. But in combination with other publicly available state databases, it becomes a very effective profiling tool. The declaration information of officials in the VID system is currently freely viewable without user identification. In the era of artificial intelligence, the collection, structuring, and linking of huge amounts of data takes not months, but minutes. This means that such data can be systematically collected and regularly updated also by the services of Russia, Belarus, North Korea, or other countries. By combining CSDD's stolen data with publicly available declarations and other databases, it is possible to profile: 👮 police officers; 🪖 soldiers; 🛂 border guards; 🕵️ security service employees; 🏛️ officials and their families. This is already a national security issue. Declarations must remain accessible to the public, but I see no justification for them being mass-copied anonymously. The solution can be very simple — the information remains public, but access is after authentication, for example, with one's profile at https://t.co/2abj1S4l9U. 🌲 AND I HAVE NOT FORGOTTEN THE @valstsmezi CYBERATTACK. From the Minister of Agriculture @ArmandsKrauze I expect a concrete answer: who in Latvian State Forests was responsible for the systematic failure to update server software, which allowed the attacker to exploit vulnerabilities? Next week I want on the table: ➖️ the name and surname of the responsible official; ➖️ an explanation of how this was allowed; ➖️ information on what consequences and responsibility will follow. 🇱🇻 WE DO NOT LIVE IN A PEACETIME DIGITAL ENVIRONMENT. Latvia lives under constant hybrid threat conditions. Next to us are aggressor states that use all possible methods against our country. At the same time, artificial intelligence has made the preparation, automation, and data processing of cyberattacks much easier. Therefore, the attitude — “surely nothing will happen to us” — is no longer acceptable in public administration. Cybersecurity is not a technical matter for the IT department. It is state security. ❓ AND I ALSO HAVE QUESTIONS ABOUT THE NCC NATIONAL CYBERSECURITY CENTRE. I am interested in how it can be that the National Cybersecurity Centre, which had about 20 million euros in 2025 and about 28 million euros in 2026, has not been able to achieve significantly higher resilience of state systems against such attacks? That is very serious funding. About half of the public television and radio media budget. With such funding, there must also be a measurable result: ✅ how many institutions have actually been tested; ✅ how many vulnerabilities have been eliminated; ✅ in how many systems multi-factor authentication has been introduced; ✅ in how many institutions have https://t.co/Y2dCsXsES5 sensors been installed; ✅ how many real cyberattack simulation tests have been conducted; ✅ and who is responsible if known risks remain unaddressed for years. I have questions. And I expect very concrete answers. Cybersecurity cannot be fixed with presentations, strategies, and reports.
Open referenced post