Latvia

Situation Summary

Latvia remains at composite threat level 144 globally (score 9), with no discrete tracked security events classified as major incidents. However, the past week has seen a confluence of cyber, airspace, law-enforcement, and sanctions-compliance activities that signal elevated operational tempo across state institutions and border security. The northeastern regions—particularly Rēzekne, Daugavpils, and surrounding municipalities—continue to register the highest sub-national risk scores, driven by proximity to the Russia–Belarus border and airspace exposure.

Key Developments

• Riga, 1 September (disclosed 2 Sept): Road Traffic Safety Directorate (CSDD) suffered a major data breach exposing personal and vehicle registration data on ~1.2 million individuals and ~200,000 legal entities—approximately two-thirds of Latvia's population. Heightened risk of identity theft, fraud, and targeted exploitation of vehicle-owner information.

• Ludza and Alūksne regions, 31 Aug–1 Sept (night): Latvia issued two air raid alerts after an unidentified drone violated national airspace, prompting NATO Baltic Air Policing fighter-jet scrambles. Alerts were lifted within 25–40 minutes as the drone continued toward Estonia; no further violations recorded subsequently.

• Alūksne Municipality, 1 September, 03:37: Latvian National Armed Forces issued an orange-level airspace threat warning, instructing residents to shelter indoors and report suspicious low-flying objects. Warning reflected heightened precautionary posture in the northeast.

• Latvia nationwide, 2 September onward: "Namejs 2026" national defence exercise commenced, involving ~12,000 troops, Home Guard, and allied forces through 8 October. Exercise accounts for increased military movements and is planned activity; no airspace incidents coincided with its start.

• Riga, 3 September: State Security Service (SSS) conducted raids on four locations of *Mnogoknig* bookstore chain in response to suspected EU sanctions violations regarding importation of Russian and Belarusian printed products following Latvia's 1 September import ban.

• Riga, 4 September: Authorities seized 847,800 cigarettes lacking Latvian excise stamps in a criminal proceeding over large-scale illegal tobacco storage and sale, reflecting active smuggling infrastructure.

• Germany–Latvia nexus, 2–3 September: German authorities identified a Latvian citizen and Russian national from Belarus as suspects in a planned drone attack on Leipzig Airport. Latvian security confirmed the Latvian suspect has resided in Russia for several years; bilateral investigation ongoing.

• Latvia nationwide, 1–3 September: Baltic airspace remained calm on 2–3 September with no repeat drone incursions or new violations recorded following the 1 September incidents.

Highest-Risk Areas

The northeastern municipalities of Rēzekne (risk 68) and Daugavpils (risk 65) dominate the sub-national ranking, followed by contiguous rural novads (Rēzeknes, Ludzas, Balvu, Preiļu, Krāslavas). This concentration reflects geographic proximity to Russia and Belarus, ongoing airspace sensitivity demonstrated by the 1 September drone incursions, and historical patterns of cross-border trafficking and smuggling. The recent cigarette seizure and sanctions enforcement activity underscore active law-enforcement response to illicit trade flows in these zones.

How GeoBit Would Assist

Security teams protecting personnel or assets in Latvia would benefit from AOI Monitoring & Early Warning on the northeastern border regions and airspace—particularly Ludza, Alūksne, and Rēzekne—to provide persistent watch and rapid alerting on drone activity or airspace violations. Cyber threat & entity extraction capabilities would help track ongoing fallout from the CSDD breach, correlate exposed identity data with fraud or targeting campaigns, and monitor dark-web marketplaces. Routing & Network Analysis would support alternative journey planning for personnel in high-risk municipalities, particularly during the Namejs 2026 exercise window.

7-Day Outlook

The Namejs 2026 exercise will continue through early October, maintaining elevated military activity and potential localized traffic or access constraints in affected regions. Northeastern airspace will likely remain under heightened NATO alert given the 1 September precedent; any further drone activity should be expected to trigger rapid response. Cyber-security and financial-fraud investigations (CSDD breach, insolvency fraud case, sanctions enforcement) will continue in parallel, with potential for further business disruptions or asset seizures.

Highest-Risk Areas — Ranked

Previous Weekly Briefs

A new Latvia brief is written every Monday, covering the week — each with its own risk map and downloadable CSV. Use the calendar to go further back.

• September 1, 2026⬇ CSV · $5
• August 30, 2026⬇ CSV · $5
• August 28, 2026⬇ CSV · $5
• August 26, 2026⬇ CSV · $5
• August 24, 2026⬇ CSV · $5
• August 22, 2026⬇ CSV · $5
• August 20, 2026⬇ CSV · $5