Lithuania has suffered a major data breach at the State Enterprise Center of Registers, the agency responsible for official registries and citizen databases.

Lithuania’s Prosecutor General’s Office said more than 600,000 records were downloaded from the center’s systems. The center itself clarified that only data contained in real estate registry extracts was exposed — names, surnames, identification numbers, dates of birth, and property information.

The center said phone numbers, email addresses, bank account details, service payment information, real estate transaction documents, court rulings, cadastral documents, and building plans and other attached documents were not among the compromised data.

The Lithuanian outlet Volna Litva said that while for an ordinary person this amounts to an “unpleasant leak,” for political emigrants from Russia and Belarus the information “could be a matter of personal safety” — in particular because it could expose the legal entities through which exiled media outlets and NGOs operate in Lithuania.

As one example of how personal information can be misused, Volna Litva recalled the March 2024 attack in Vilnius on opposition politician and Anti-Corruption Foundation representative Leonid Volkov. As Volkov was getting out of his car outside his home, a man attacked him and struck him several times with a hammer. The case is still ongoing.

According to the State Enterprise Center of Registers’s account, the attackers exploited access administered through another government agency — which one was not specified. The Prosecutor General’s Office added that the connections originated from a “foreign state.” The outlet 15 min, citing a source, reported that the data was extracted through accounts belonging to the Migration Department, the agency that handles the affairs of foreigners in Lithuania. That was later confirmed by the head of Lithuania’s Criminal Police Bureau, Arunas Maskoliunas.

Preliminary damage estimates put the cost at no less than 111,000 euros. After news of the breach broke, residents began checking their data en masse, forcing the center to suspend its verification service; officials promised to restore it once the surge subsided. Resignations followed: on May 25, three days after the breach became public, State Enterprise Center of Registers director Adrijus Jusas stepped down.

The Lithuanian government stated it was not avoiding responsibility, but that any resignation would be the best gift to their enemies. Prime Minister Inga Ruginiene said it was very important to emphasize that the government must not run away from problems but must solve them.

The director of the State Security Department, Remigijus Bridikis, said it remained unclear whether Russia was responsible for the hack. “This is sufficiently deep technical work to reliably establish attribution to one country or institution. In this case I cannot assert [that Russia is responsible for the hack],” Bridikis said. He added, however, that China, Russia, and North Korea are the main players in cyberspace and “seek to collect information and, when necessary, use it to destabilize the infrastructure of states.”

The leader of the conservatives and former Lithuanian defense minister, Laurynas Kasciunas, by contrast, suspected the GRU’s cyber unit of involvement. In his view, the hacked registry could be used to find property addresses belonging to intelligence officers, military personnel, diplomats, or politicians, which could then be cross-referenced with other data or used for surveillance and sabotage.

Kasciunas wrote on Facebook that such data could be especially valuable in the first hours of a war or a large-scale hybrid attack, when the goal is the rapid disruption of state governance, military coordination, and critical infrastructure.