How a Hacker Remained Undetected in the Latvian State Forests System for Almost Two Weeks: New Details of the Cyber Attack 0 136

Latvian Prime Minister Andris Kulbergs provided new details regarding the investigation into the cyber attack on the information systems of Latvijas valsts meži (LVM).

According to him, the hacker infiltrated the internal system of the enterprise on June 11, but only began the active phase of the attack on the night of June 22 to 23.

Thus, the perpetrator was inside the system for almost two weeks, and for several days—after gaining access—remained undetected.

"It is unacceptable for the system to lack tools capable of detecting such anomalies," emphasized the Prime Minister after an operational meeting of the Cabinet of Ministers.

Kulbergs stated that it is currently being investigated why the company did not fully implement the requirements of Latvian cybersecurity legislation and how these deficiencies were not identified during the audit.

According to preliminary data, specialists have already managed to recover about 85% of the data accessed by the perpetrator.

At the same time, the Prime Minister assured that there is no threat to state systems. However, among the stolen information are sensitive data, the final assessment of which is still ongoing.

Kulbergs also reiterated that the cyber attack did not affect either the electoral system or the module that LVM was working on, despite earlier concerns.

During the discussion of the incident, the government concluded that Latvia currently lacks a single coordinator to oversee the actions of various institutions during large-scale cyber attacks. According to the Prime Minister, this function should be performed by the Crisis Management Center.

The Ministry of Defense, together with other agencies, also intends to assist state and private organizations in implementing continuity plans in case of similar incidents.

In addition, the Prime Minister announced that he would prepare a special resolution that would clearly delineate the responsibilities of all those responsible for cybersecurity issues.

The cyber attack on the IT infrastructure of LVM was detected on June 22. Following this, the company disabled several external services, including LVM GEO, the mapping system, and the Mednis application, as well as part of the internal information systems.

Responsibility for the attack was claimed by a foreign group using ransomware. According to cybersecurity expert Elvis Strazdiņš, the perpetrators demanded a ransom exceeding 600,000 euros for the decryption of the data.

The investigation into the cyber incident is ongoing by the State Police, Cert.lv, and other relevant institutions.