A cyberattack on Latvian government systems exposed personal data on 1.2 million people, prompting the resignation of senior officials. The breach, reported by The Record from Recorded Future News, hit a population base of approximately 1.89 million residents, making the incident one of the largest per-capita government data exposures recorded in the European Union.

What did the attackers reach?

The attackers accessed records covering 1.2 million individuals. At roughly 63% of Latvia's total population, the data haul touches the majority of residents, including children, working-age adults, and pensioners. The scale places the breach in the same magnitude as the 2017 Estonian ID-card vulnerability and the 2020 Finnish psychotherapy centre hack, both of which reshaped national cybersecurity policy.

Who has stepped down?

Government officials tendered resignations following disclosure of the breach. The departures signal political accountability at a level rarely seen after a data exposure of this scope. In most EU member states, technical leaders carry the blame for breaches; in Latvia, senior officeholders took the fall directly.

Why does the scale matter?

A 1.2-million-record breach carries cascading cost across three enterprise vectors:

• Identity fraud surface. Names, personal identification numbers, and addresses enable synthetic-identity attacks against Latvian banks, telecom carriers, and any service using national ID for KYC.
• Regulatory exposure. Latvia operates under GDPR. A breach affecting nearly two-thirds of residents triggers mandatory supervisory authority notification and could expose the state to class-action-style claims.
• Critical infrastructure follow-on. Compromised government credentials often seed phishing campaigns against utilities, defence suppliers, and logistics operators.

How does this compare to recent EU incidents?

The Estonian 2017 incident affected 760,000 ID-cards in a country of 1.3 million. The Dutch municipality Lochem leak in early 2024 touched roughly 65,000 residents. Latvia's 1.2-million figure outpaces both on absolute count and per-capita impact. Recorded Future's incident database tracks only a handful of European government breaches crossing the one-million threshold.

What questions remain unanswered?

Several operational details will determine the long-term cost:

• Entry vector. Initial reporting does not name the attack type — ransomware, supply-chain compromise, SQL injection, or insider leakage remain plausible.
• Data class. Whether the exposure covers biometric templates, financial records, or only demographic identifiers will reshape remediation cost.
• Vendor involvement. Whether a third-party contractor's system served as the initial access point has not been disclosed in available reporting.
• Notification timeline. GDPR requires supervisory notification within 72 hours of awareness. The gap between incident detection and public disclosure will draw regulatory scrutiny.

What should CISOs take from this?

For enterprise security leaders operating in or with the Baltic states, the incident delivers four immediate action items:

1. Audit connections to Latvian government identity services. Any system using Latvian eID for authentication or KYC should be reviewed for credential reuse risk.
2. Refresh fraud-detection thresholds. A population-scale breach typically produces a wave of synthetic-identity attempts within 30–90 days.
3. Re-verify third-party risk posture. Government breaches frequently originate in contractor environments; vendor access reviews should accelerate.
4. Prepare regulatory disclosure templates. Cross-border enterprises holding data on EU residents must align with both the Latvian supervisory authority and their home-country regulator.

The resignations confirm that political accountability in the Baltic bloc now follows data exposure as directly as it follows financial misconduct. CIOs and CISOs operating government-facing systems should treat the 1.2-million figure as a baseline trigger for board-level briefings, not merely a news item.

Latvia's CERT and the Data State Inspectorate are expected to publish a joint technical post-mortem. Until then, the headline number — 1.2 million — is the metric every security team with Baltic exposure should reference in their next risk register update.