The CSDD data breach: what it means if you are learning to drive in Latvia

Link copied

In early August 2026 CSDD (Ceļu satiksmes drošības direkcija, the Road Traffic Safety Directorate) — Latvia's state body for driving exams, licences and vehicle registration — suffered a cyberattack. The personal data of 1.2 million people and around 200 000 companies was taken from its system, all of it drawn from payments made to the directorate over the past 18 years. If you have ever paid for an exam, for a licence or for registering a car in Latvia, your details are almost certainly in there. Let me go through it calmly: what leaked, how to check whether you are affected, and what is genuinely worth doing.

What actually ended up in the wrong hands

What leaked was not the driver database, nor the licences themselves, but the data held in payment receipts. As of 20 August the directorate listed:

first name and surname — or the company name;
personal identity code — or the company registration number;
the amount paid and the date of payment;
the vehicle registration plate number;
the address that was on record on the day the service was provided.

Not affected, according to the directorate: the client's phone number, e-mail address, banking details and CSDD e-service credentials. That is an important detail — and below I explain why it changes less than you might expect.

How to check whether you are in it

Since 27 August every client has been able to look up, through the CSDD e-services, whether their data was among what was taken and exactly which items. You do this by logging in to your own profile at e.csdd.lv.

One warning sounds trivial, but it is exactly where people get caught: type e.csdd.lv into the browser yourself. Do not follow a link from an e-mail, a message or an advert — not even one that looks flawlessly official.

The Data State Inspectorate, Latvia's data protection supervisory authority, points out separately that it holds no such database: the only place to find out what leaked about you specifically is the CSDD e-services.

Why your phone and e-mail were not in the breach — and the calls will come anyway

This breach did not hand fraudsters your phone number or e-mail address. But they have numbers already — from other sources, from adverts, or simply by dialling numbers in sequence. What they lacked before was convincing detail about you personally.

A caller can now give your name, your personal identity code, your car's registration number, your address and the exact amount you really did pay CSDD a couple of years ago. All of it will be true. And that is why the familiar way of telling a fraudster apart from an institution has stopped working.

Verify the channel, not what the caller knows

The old logic was simple: if the person on the other end knows non-public things about me, they must be calling from a real organisation. After this breach that logic breaks down — knowing the facts no longer proves anything.

There is one rule that still works: do not test what the caller knows — test how they reached you.

Hang up and call back yourself, using a number from csdd.lv or from the CSDD mobile app. Not the number you were given, and not the "call back" button in your call history.
Never enter or confirm access codes for a service you did not start yourself. A genuine institution will not ask you to read a code aloud.
Do not open links in e-mails or text messages about fines, surcharges or "confirming your details". The directorate has already warned that fake e-mails and messages about supposedly issued fines are being sent in its name.
Do not trust the logo. A name and a visual style are easy to fake — it is safer to open the site by typing the address in by hand.

If you have only recently passed your test, be especially careful with anything carrying the word "fine": what new drivers in Latvia actually get penalised for, I have covered separately.

Compensation: what the directorate and the inspectorate each say

By 9 September CSDD had received around 2500 requests for compensation, most often for about 10 000 euros. The directorate considers such claims premature and has promised to inform clients about the next steps.

The Data State Inspectorate puts it more precisely — and, for a reader, more usefully:

You do not have to wait for its decision. The inspectorate's investigation and a compensation claim are two separate processes.
The inspectorate neither awards nor pays compensation. A claim is made against the data controller, and the dispute is settled in court.
You do not need to file an individual complaint — the investigation is already under way, and a separate complaint will not speed it up.
The fact of a breach on its own does not create a right to compensation. You have to show that harm actually occurred and that it was caused by the breach; the court assesses both.

What happens next, and on what timescale

The law gives the inspectorate six months from the day a case is opened; for objective reasons the deadline can be extended to a year, and high-priority cases are usually dealt with within four to nine months. The investigation may equally conclude that the directorate acted appropriately, or lead to orders and a fine — nobody is predicting the outcome yet.

Running alongside it are an internal investigation by the transport ministry, a review by the Prosecutor General's Office and criminal proceedings opened by the State Police; the CSDD board and council have resigned. Targeted remedies are under discussion too: in mid-September a bill was tabled in the Saeima, Latvia's parliament, that would give affected people one free basic state technical inspection for one vehicle from 2027. For now that is a proposal, not a rule in force.

What is genuinely within your control

The list is short, and that is deliberate — short lists get followed, long ones get forgotten.

Check your own data in the CSDD e-services, so you know what is known about you.
Turn the "I will call back myself" rule into a reflex rather than an exception.
Never make a decision under pressure on the phone — financial or otherwise.
Follow the official updates on csdd.lv and dvi.gov.lv rather than second-hand accounts.

The breach changes nothing about learning to drive: exams are being held, paperwork is being processed, and lessons carry on as usual. If you are still gathering documents for category B, the procedure is unchanged — what to arrange and where has stayed the same. And the first two years on a licence run under the same rules as before.

Data that has already leaked cannot be recalled, and that is the one genuinely unpleasant part of this story. Everything else comes down to a single habit: never make a decision inside the same conversation in which it was put to you. That habit serves you far beyond the CSDD story.

These details were verified in September 2026 and the situation is still developing — for the current position, always check csdd.lv and dvi.gov.lv.