Massive security breach suspected at Latvian tax office

Feb 15, 2010, 15:28 GMT

Riga - The State Revenue Service (VID) in Latvia admitted Monday that its electronic security systems may have been breached and that millions of confidential documents could have been hacked.

The Latvian television news programme De Facto said Sunday night that 120 gigabytes of data consisting of 7.4 million individual documents had been leaked from VID's database as a result of a data 'hole' in an electronic tax declaration system.

The incident represented the biggest data breach in Latvia's history and included information on businesses, individuals and public figures, De Facto claimed, and said it could vouch for the accuracy of the leaked data, which it said included the programme makers' tax codes and rates of pay.

In a statement, VID said only that there was 'a suspicion of a security incident involving possible data loss from the VID information system.'

The hole appeared to have been created in the system intentionally by a senior figure within VID, claimed representatives of a hackers' group calling themselves the Fourth Awakening People's Army (4ATA), which De Fact said obtained the information over a three-month period.

Police have opened an investigation into the incident.

Despite the scandal surrounding the data breach, on Monday morning the official VID website was still encouraging businesses to declare their tax online and claimed the system was safe.

It is not the first time in recent months that VID has been at the centre of controversy. Finance Minister Einars Repse from the New Era political party attempted last month to dismiss VID director general Dzintars Jakans for a range of disciplinary offences, including gross insubordination.

However, Jakans was defended by backers within the Peoples Party, which is also in the ruling coalition, and last week he was instead moved to a new job within the Finance Ministry.

Repse told reporters Monday that the data leak was 'extremely serious' but had been plugged. He refused to comment on who he thought was responsible for the leak, saying law enforcement agencies would decide the matter after investigations were concluded.