Latvian police have detained a man suspected of stealing customer data from TSC, an appliance repair company that also serves customers in Estonia. The attack started on the company’s website. According to the police, the suspect did not pick his targets; he let a tool find weak websites for him.
What happened at TSC?
TSC, part of the Latvian LMT group, repairs household appliances and smart devices in Latvia, Lithuania and Estonia. Postimees reported on 14 September that attackers had targeted the company’s website. They reached part of the database behind it and copied customers’ first and last names, company names, phone numbers and email addresses.
Preliminary findings put the share of affected customers at about 7% of those who had booked a repair through the website. A small part of the data concerns customers of the Estonian and Lithuanian branches; no figure for Estonia has been published. Data stored on the devices handed in for repair was not affected.
Who is the suspect?
Latvia’s State Police cybercrime unit detained the suspect on 15 September and announced it on 23 September. He is suspected of attacking at least two Latvian companies in order to extort them. The first case under investigation dates from February this year; the second was the attack on TSC in early September.
According to the police, he used an automated tool to scan large numbers of websites for vulnerabilities. Investigators say that where he found a way in, he exported the database, then emailed the company from anonymous accounts and demanded money for not publishing the data. The investigation found that the data taken from TSC had not been passed on to third parties.
LMT’s security service and Latvia’s CERT.LV helped identify him. Police are checking possible links to other attacks in Latvia and abroad. He is suspected of unauthorised access to information systems, extortion and illegal actions with information, and is presumed innocent unless proven guilty.
Why does this matter for a small company?
According to the police, TSC was not singled out. When an attacker scans the whole internet, it is enough for a website to be online and to have one unpatched weakness.
A company website is rarely just a shop window. Order and contact forms often write to the same database that holds earlier orders. A vulnerability on the site can therefore become a direct route to customer data.
Even plain contact details are valuable: a name, phone number and email address are enough to write a convincing message about a real repair order. For the company, a leak also brings reputational damage and dealings with the data protection authority.
This kind of extortion does not encrypt anything or stop the business working. Backups do not help either: the data is already in someone else’s hands.
What should you do?
- Keep the website software updated. Ask whoever runs your website, or your IT partner, to update the content management system, its plugins and the server software. The Latvian police gave businesses the same advice: check your systems and fix the vulnerabilities you find.
- See your site the way the scanner does. An automated tool looks at your website from the outside. A website security check gives you that same outside view.
- Keep less data on the web server. Review what your forms collect and how long you keep it. Delete old orders you no longer need, or move them off the web server.
- Know where to report. A personal data breach generally has to be reported to the Estonian Data Protection Inspectorate within 72 hours. Report an extortion email to the police and to CERT-EE (cert@cert.ee). If you think your site has already been attacked, see our incident help page.
- If you are a TSC customer, stay alert. Treat emails and calls that refer to your repair order with caution, and check them through TSC’s official contact details.
Sources
- Postimees: Kodumasinate remondifirma TSC langes küberrünnaku ohvriks, juhtum puudutab ka Eesti kliente
- BB.LV: Police detained an alleged hacker after attacks on Latvian companies
- Estonian Data Protection Inspectorate: Breach notification
We used AI to help write this post. The facts come from the sources listed below and reflect what was known on the day the news broke. How we use AI.
