Latvia’s Road Traffic Safety Directorate Suffers Major Cyberattack Amid Monitoring Failures Latvia’s Road Traffic Safety Directorate (CSDD) was hit by a significant cyberattack between August 7 and 8, resulting in the theft of personal data belonging to 1.2 million individuals and records from 200,000 legal entities spanning 18 years of payment transactions. The breach was discovered and contained within hours by CSDD’s own cybersecurity team, not its contracted IT monitoring provider, Tet, which failed to detect the intrusion. CSDD Chairman Aivars Aksenoks revealed that Tet, a telecommunications and technology firm under a five-year contract, was responsible for infrastructure maintenance, firewall protection, and incident monitoring services for which CSDD pays a substantial monthly fee. Despite this, Tet provided no alert during the attack. When CSDD later inquired, Tet confirmed it had not identified the breach. The attack exploited a vulnerability in an internet-accessible CSDD system, according to CERT.LV, Latvia’s cybersecurity incident response team. While no customer phone numbers or email addresses were compromised, the scale of the data exposure has raised concerns about potential misuse. Aksenoks also addressed claims that CSDD had rejected a monitoring agreement with CERT.LV, clarifying that no formal proposal had been submitted through proper administrative channels. Instead, a draft agreement was exchanged informally between a CERT.LV employee and a CSDD specialist who has since left the organization. CSDD has since forwarded the agreement to CERT.LV for signing. Political and Operational Fallout Latvian Prime Minister Andris Kulbergs (Progressive Party) held CSDD’s Management and Supervisory Boards accountable, instructing the Transport Minister Rihards Kozlovskis to assess whether officials should retain their positions. Kozlovskis has launched an accelerated internal investigation, with findings due in early September. The prime minister did not rule out the possibility of the attack being a hybrid operation by a foreign state targeting Latvia’s critical infrastructure. Tet’s Role and Ownership Tet, which provides CSDD’s IT infrastructure, is 51% state-owned through Public Asset Manager Possessor, with the remaining 49% held by Telia Company’s subsidiary, Tilts Communications. Telia is in the process of selling its stakes in Tet and Latvijas Mobilais Telefons (LMT) to Latvenergo, the Latvia State Radio and Television Centre (LVRTC), and a strategic investor, which could result in each party holding ~25% ownership in both companies. In 2025, Tet Group reported €302.85 million in revenue (down 5.8% year-over-year) and a €20.59 million profit (up 14.2%). Tet itself saw €191.67 million in revenue (up 3.4%) and a 49.5% profit increase to €18.38 million. CSDD, a state-owned joint-stock company under the Ministry of Transport, oversees vehicle registration, driver’s license issuance, roadworthiness inspections, and other critical services. The incident underscores vulnerabilities in Latvia’s cybersecurity oversight of public-sector infrastructure.