After the CSDD data breach: how to protect yourself from fraudsters

A cyberattack on Latvia's Road Traffic Safety Directorate (CSDD) has exposed the data of 1.2 million individuals and 200,000 legal entities, including information about payments made to the directorate over the past 18 years. National cybersecurity institution Cert.lv has issued guidance on how affected residents should respond.

The main threat

According to Varis Teivāns, deputy head of Cert.lv, the biggest risk is that the leaked data could fall into the hands of fraudsters, who could use it to craft far more convincing and personalized scam messages, emails, or phone calls.

Recommended steps

If a person's eParaksts mobile user number matches their personal identity code, Cert.lv recommends changing it to a randomly generated seven-digit combination, which can be done through the eParaksts.lv profile. Since April 2022, new eParaksts users have had their personal code used as the default user number.

Because the personal code can serve as a login identifier across several digital services — not only CSDD but also Latvija.gov.lv, the e-health system, and the EDS tax portal — people are urged not to approve any e-identity authentication requests they did not initiate themselves. Fraudsters could trigger an authentication attempt hoping a user approves it by mistake. An additional safeguard is a three-digit security code that must be entered in the browser to complete authentication.

Cert.lv is urging heightened skepticism toward texts, calls, and emails that appear to come from CSDD or other institutions and pressure recipients into urgent action. When in doubt, people should independently open the official website or app rather than clicking links in received messages, and should watch for language or spelling errors.

Checking whether your data was exposed

To find out if their data was among those leaked, residents can contact any CSDD customer service center or reach the directorate's data protection specialist, Uldis Sīpols. If a breach is confirmed, individuals also have the right to file a complaint with the State Data Inspectorate.