Latvian police trace two extortion breaches to one man running an automated scanner
Latvian police say one man with an automated scanner and an anonymous mailbox turned two mid-sized company websites into an extortion business. Investigators linked the two cases on similarities in the methods used.
The Watch · Security desk
What happened
- One attack took place in February; the second was detected in early September at TSC, the household appliance and smart device repair company inside telecoms group LMT.
- Police said the suspect did not appear to pick his victims, and that automated tools were pointed at different websites and online resources to find vulnerabilities.
- For most TSC customers, the repair-order records reached in the breach held names or company names, telephone numbers, email addresses and repair receipt numbers.
- The search produced evidence of other alleged attacks on companies in Latvia and abroad, and those investigations are still open.
Why it matters
- Who's exposed exposure Some of the TSC records went further than contact details: device IMEI numbers, device access codes, bank account numbers and access codes for repair facilities. Whoever held the export had the handsets and the repair premises within reach.
- What's now possible capability One operator covered discovery, theft and the ransom demand, with no affiliate structure, no broker and no leak site. That puts the cost of extorting a mid-sized firm at the price of a scanner and an anonymising service.
- What it limits constraint An automated scan picks victims by what it finds open. Small and obscure companies get selected alongside everyone else. That puts every internet-facing form and database on the list, including the ones a company has forgotten it runs.
- What it sets up precedent Latvia is running this as a five-year-maximum matter. That five-year maximum is the local sentencing frame for scan-and-extort work by a lone operator.
Next story · Security · Oct 9
Arrests of ShinyHunters suspects reach at least three in two weeks after FBIjobs.gov breachConfirmed14 publishers
Once the scan flagged a vulnerability, the suspect reached the website's database and exported what it held, including restricted-access records, according to the State Police [6]. The location the activity came from was hidden behind what police called virtual camouflage tools [7]. The payment demand then arrived at the victim company from an anonymous email account [8].
The February case gave investigators a pattern, and the TSC intrusion detected in early September matched it. Police linked the two on similarities in the methods used [5], analysing the TSC incident with LMT Security Service and CERT.LV to establish a possible connection [9]. From the February detection to the arrest is about seven months [25].
TSC said the intruders exploited a vulnerability on its website to reach a database of customer repair orders [13]. Content stored on the devices customers had handed in was not affected [16]. The company suspended its website, brought in outside cybersecurity experts and kept repairs running through staffed customer service [18]. It has not said how many customers were affected or which vulnerability was exploited [23].
The State Police described the man as born in 2003 [1]. The Record reported him as 23 and said his identity has not been disclosed [2]. He is a suspect in both criminal proceedings, under Latvian provisions covering unauthorised access to automated data processing systems for financial purposes, extortion, and unlawful actions involving such systems [20]. Police said they have reason to believe their response stopped the stolen personal data from being passed to third parties [17], and noted that he is presumed innocent until guilt is established under the law [22].
TSC repairs smartphones, smart devices and household appliances in Latvia, Lithuania and Estonia [24]. The company said its IT systems run separately from the rest of the LMT group, and there is no indication that LMT's telecommunications network was compromised [19].
What to watch
- Whether the evidence seized in Riga concerning companies in Latvia and abroad produces further charges or foreign requests.
- Whether TSC identifies the vulnerability class or publishes a count of affected repair customers.
- Whether CERT.LV reports the same scan-then-extort pattern against other Baltic mid-sized firms.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence74
- Adoption
- Not scored
- Hype gap+8
- Incentives45
- Confidence72
Perspective Coverage
3 publishers- Builder
- Builder 23%
- Operator
- Operator 65%
- Investor
- Investor 12%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Latvian State Police arrested a man born in 2003 over alleged cyberattacks against at least two Latvian companies.
- [2]
The Record reported that the arrested man is 23 years old and that his identity has not been disclosed.
- [3]
The State Police said the suspect accessed company databases, extracted personal data and attempted to demand payment in exchange for not disclosing the information.
- [4]
One of the attacks took place in February, while a second incident was detected in early September at TSC, a household appliance and smart device repair company that is part of the LMT group.
- [5]
Investigators linked the two cases based on similarities in the methods used.
- [6]
According to the State Police, the attacker used an automated tool to scan websites for vulnerabilities, and after identifying one gained access to a website database and exported information, including restricted-access data.
- [7]
The attacker allegedly used virtual camouflage tools to hide the actual location from which the activity was carried out.
- [8]
After completing the attack, the person contacted the affected company through an anonymous email account and demanded payment to prevent the stolen information from being disclosed.
- [9]
The State Police worked with LMT Security Service and CERT.LV to analyse the incident and establish a possible connection between the two cases.
- [10]
On September 15 police detained the suspect and carried out additional procedural actions, including a search at an address in Riga.
- [11]
Investigators obtained evidence and information concerning other alleged cyberattacks against companies in Latvia and abroad, and those investigations are continuing.
- [12]
Police said the suspect did not appear to target specific companies; instead automated tools were allegedly used to scan different websites and resources for vulnerabilities.
- [13]
TSC disclosed the data breach earlier this month after unidentified attackers exploited a vulnerability on its website and accessed a database containing information related to customer repair orders.
- [14]
In most cases the information potentially accessed included names or company names, telephone numbers, email addresses and repair receipt numbers.
- [15]
In certain cases the exposed information could also include device IMEI numbers, device access codes, bank account numbers, delivery or repair addresses and access codes for repair facilities.
- [16]
TSC said the incident did not affect data or content stored on devices submitted for repair.
- [17]
The State Police said there is reason to believe its prompt response prevented the unauthorized personal data from being passed to third parties.
- [18]
TSC temporarily suspended its website after discovering the incident and launched an investigation with cybersecurity experts, while equipment repair services continued through contact-based customer service.
- [19]
TSC said its IT systems operate separately from those of other LMT group companies, with no indication that LMT's telecommunications network was compromised.
- [20]
Police cited provisions of Latvia's Criminal Law covering unauthorized access to automated data processing systems for financial purposes, extortion and unlawful actions involving such systems.
- [21]
The man could face up to five years in prison.
- [22]
The State Police reminded that the suspect is presumed innocent until guilt is established under the procedures prescribed by law.
- [23]
TSC has not disclosed how many customers were affected nor has it identified the vulnerability exploited in the attack.
- [24]
TSC, which repairs smartphones, smart devices and household appliances, operates in Latvia, Lithuania and Estonia.
- [25]
About seven months separate the February detection of the first attack and the suspect's detention on September 15.
Sources
3 independent publishers whose own reporting we read for this story.
- thecyberexpress.com
1 article · September 23, 2026
Latvia Hacker Arrested Over TSC Data Theft and Extortion Attempt
- therecord.mediaLatvia arrests suspected hacker for electronics repair company breach
1 article · September 23, 2026
- Latvian State Police
vp.gov.lv
1 article · September 24, 2026
Topics and entities
Topics
- Cybercrime Law Enforcement Operations
- Cyber Extortion
- Automated vulnerability scanning
- Data Breach
Entities
- Latvian State Police