Security recommendations for eParaksts mobile users after the CSDD cyber incident

Based on information publicly released by “Road Traffic Safety Directorate” (CSDD) regarding the cyberincident identified on August 10, 2026, which resulted in attackers gaining access to personal data, including personal identification numbers, we urge everyone to pay closer attention to their digital security.

What data was leaked in the CSDD cyberattack?

CSDD reports that the data from payment receipts has been leaked, including personal identification numbers, first and last names, vehicle registration numbers, addresses, and information about completed payments.

Although a personal identification number does not grant access to eParaksts services or the ability to verify a person’s identity, it can be used in fraud attempts.

Therefore, we urge you to pay extra close attention and carefully evaluate any unexpected requests for e-Identity verification or when receiving calls, texts, or emails, including those on behalf of eParaksts.

Check your eParaksts user number

eParaksts mobile and eID Scan apps use user ID. It can either be your personal identification number or a randomly generated seven number sequence.

Since April 2022, new eParaksts users have had their personal identification number used as their user ID by default.

Considering that the data leaked as a result of the cyberattack on CSDD also includes personal identification numbers, we recommend that eParaksts mobile users consider changing their user ID to a randomly generated seven-digit combination.

User ID can be changed by logging in to the eParaksts.lv portal via eParaksts mobile or eID card, and in the “Products” section click “Change user number”. If you use eID Scan app, when you change the eParaksts mobile user number, the changes also will automatically be applied to your eID Scan user number.

It is important to remember that the user number by itself does not guarantee access to eSignature mobile, eID Scan or e-services, that use these tools for authentication.

However, if attackers obtain a person’s identification number, they may attempt to initiate e-ID verification request in hopes that the user will confirm it without thinking.

That’s why in eParaksts solutions there are multiple integrated security mechanisms that help protect the user even if their personal identification number has been disclosed to others.

The eID verification process is protected by a three-digit security code

To proactively protect users from fraud attempts, an additional security measure – a three-digit security code – has been in use as part of the e-ID verification process since last years November.

This feature helps prevent situations in which scammers, by entering randomly selected user numbers, might try to trick a user info carelessly confirming their e-Identity on their phone.

The three-digit security code connects e-Identity requests to a specific user. Even if the fraudster has the user’s number or personal identification number, the e-Identity verification process cannot be completed without this code. The user receives the code directly on their smartphone via the eParaksts mobile app and enters it into the browser where identity verification takes place.

Never approve a request that you did not initiate

If you receive a request in the eParaksts mobile app to confirm your e-Identity, but you have not attempted to log in to any website or e-service yourself, you must not confirm such a request.

Before accepting e-Identity, always make sure that:

• You initiated the request
• You know which service you’re accessing
• The request has not come unexpectedly.

Remember!

Never give other people your:

• eParaksts mobile PIN codes;
• eID card PIN codes;
• passwords;
• three-digit security codes.