Latvia’s State Forestry Company Hit by Prolonged Ransomware Attack Latvia’s state-owned forestry company, Latvijas Valsts Meži (LVM), is still recovering from a ransomware attack that disrupted its IT systems for weeks. The incident, first disclosed in late June, took key services including a mapping platform, hunting application, and contractor communication systems offline. Authorities revealed that attackers had likely been inside LVM’s network for over a week before detection. LVM’s CTO, Maris Kuzmins, stated that while the situation has stabilized, full restoration remains challenging, with two-thirds of contracted customers still unable to access affected systems. The breach exploited an unpatched vulnerability in a system that had not been updated for two years, though the specific software was not disclosed. LVM confirmed it received no ransom demand and would refuse to pay if contacted. As one of Latvia’s most profitable state-owned enterprises, LVM manages forests, timber sales, public recreation sites, and geographic mapping services. The attack, attributed by Latvia’s CERT.LV to a financially motivated foreign ransomware group with a history of targeting NATO and EU entities, resulted in the leak of 44GB of stolen data. Exposed files included internal documents, emails, software code, digital certificates, cryptographic keys, and user credentials though investigators believe the attackers accessed far more than they published. The breach raised concerns due to LVM’s role in developing features for Latvia’s electronic voter registration system. However, authorities confirmed the election infrastructure was unaffected, as the software was built in a separate environment and never stored in LVM’s corporate systems. CERT.LV reviewed all related code deliveries and found no evidence of tampering, deeming the system secure for upcoming parliamentary elections. The same threat actor also compromised a server at Latvian pharmaceutical company Olpha (formerly Olainfarm), though the breach was contained with no further damage detected. Despite the shared attribution, CERT.LV stated the two incidents were technically unrelated. The group remains active in Latvian cyberspace, actively probing for vulnerabilities in public and private sector networks.