Latvia’s State Forestry Company Still Restoring Systems After Ransomware Attack
Summary
Latvia’s state-owned forestry company LVM is still restoring systems weeks after a ransomware attack disrupted services. CERT.LV says attackers stole and leaked data; about two-thirds of contract customers still lack access to affected systems.
Key points
- The ransomware attack took LVM’s mapping platform, hunting application, and contractor and customer communication systems offline.
- LVM says recovery is ongoing; about two-thirds of customers with service contracts still lack access to affected systems.
- Authorities said the attackers were likely inside LVM’s network for more than a week before detection.
- LVM’s CTO said attackers exploited a vulnerability in a system that had not been updated for two years; the software was not identified.
- CERT.LV attributed the intrusion to an unidentified foreign, financially motivated ransomware group. The attackers reportedly leaked about 44 GB of data, including documents, emails, code repositories, certificates, keys, and credentials.
- Authorities said Latvia’s election infrastructure was not compromised, and CERT.LV found no malicious code or unauthorized access in the election project’s software deliveries.
- CERT.LV said the same actor compromised an Olpha server; that breach was contained, with no evidence so far of broader damage. Authorities said the two breaches were technically unrelated.
Article Details
- Victim Organization
- LVM (Latvijas Valsts Mezi)
- Incident Type
- Ransomware attack involving network intrusion, data theft, and data leakage
- Data Types Exposed
- Internal documents
- Email correspondence
- Software code repositories
- Digital certificates
- Cryptographic keys
- User credentials
- Affected Data Size
- Approximately 44 gigabytes of stolen data were published online; investigators believe the attackers accessed significantly more information.
- Operational Impact
- The attack took the mapping platform, hunting application, and systems for exchanging information with contractors and customers offline. Weeks later, recovery was ongoing, and about two-thirds of customers with service contracts still lacked access to affected systems.
- Ransom Or Extortion
- LVM said it had not received a ransom demand and would refuse to pay if one were made. The attackers leaked stolen data.
- Claim Status
- confirmed