As “Latvijas valsts meži” cybersecurity incident: current information

CERT.LV collected cyber monitoring data indicates that the foreign financially motivated ransomware group responsible for the LVM attack continues activities in Latvia's cyber environment, targeting new potential vulnerabilities in state and private sector organizations. Indicators of the attacker’s infrastructure network and CERT.LV recommendations are available here: https://cert.lv/lv/2026/07/cert-lv-rekomendacijas-infrastrukturas-kiberdrosibas-noturibas-uzlabosanai-pret-kiberuzbrukumiem. Currently, the leaked information by the attacker reaches 44 GB, but the volume of potentially obtained data is likely larger. CERT.LV has verified each delivery from LVM and compared code changes for each line of software code from the first to the last delivery submitted to VDAA. The original message: https://cert.lv/lv/2026/06/cert-lv-apstiprina-latvijas-valsts-mezu-izstradata-koda-drosu-izmantosanu-velesanas. In response to the cybersecurity incident affecting AS “Latvijas valsts meži” infrastructure, CERT.LV continues to support the company in investigating the incident and mitigating its consequences. Responsibility for the cyberattack has been taken by a foreign financially motivated ransomware group, which has carried out similar actions against other companies and government institutions in different countries, including NATO and EU member states, and CERT.LV also informs international partners about the incident analysis process. We are working in emergency mode and will inform about the situation’s development.” CERT.LV Deputy Head Varis Teivāns emphasizes: “The development of additions related to the election system was handed over to the State Digital Development Agency (VDAA), and they will undergo an independent audit conducted by CERT.LV and TET.