Latvian PM Demands CSDD Leadership Resign After Data Breach

Latvian Prime Minister Andris Kulbergs has demanded the resignation of the Road Traffic Safety Directorate (CSDD) board and management, citing their inadequate response to a massive cyberattack that compromised the personal data of 1.2 million individuals and 200,000 legal entities.

Kulbergs expressed his "indignation" over the CSDD leadership's comments following the data breach, stating they "did not act as a responsible custodian." He issued an ultimatum: "Either you put your resignation on the table tomorrow, or you will face the consequences."

The cyberattack, which occurred over the past 18 years, exposed data from payments made to the CSDD. Varis Teivāns, deputy head of the CERT.lv cybersecurity incident prevention institution, confirmed the scale of the breach, noting that the attack exploited a vulnerability in an internet-accessible CSDD system. Investigations revealed that several requirements for Class A information systems, including multi-factor authentication and intrusion tests, were not met.

Despite the Prime Minister's demands, CSDD board chairman Aivars Aksenoks stated he has no plans to resign. He argued that from the CSDD board's perspective, no violations occurred. Aksenoks described the CSDD's IT system as highly complex, supporting numerous connections for dozens of institutions, and noted that the organization is gradually addressing security checks. He pointed out that new regulations were implemented last year without a transition period, making immediate compliance challenging.

The CSDD board has initiated an extraordinary audit, and an internal security committee is conducting a thorough review of the cyberattack. Meanwhile, the Saeima (parliament) is scheduled to discuss the incident.

“

Either you put your resignation on the table tomorrow, or you will face the consequences.