INSIGHTS HUB

CyberCase 360 | Issue #1: The Adversary at the Front Door

June 5, 2026

June 5, 2026

Inside Lithuania's 600,000 register data breach. Learn how a stolen partner credential bypassed security and why third-party risk management is critical.

When a foreign adversary accesses your systems by using the legitimate credentials of a trusted partner, the breach is not a technology failure — it is a third-party risk management failure.

Today, [CyberCase 360] breaks down a high-profile case from Lithuania that serves as a critical warning for cybersecurity posture across Europe.

🕵️‍♂️ 1. The Breach

On May 22, 2026, Lithuania’s Prosecutor General’s Office confirmed that attackers gained unauthorized access to more than 600,000 records held by the Centre of Registers (Registrų centras) — the state agency maintaining the country’s real estate and legal-entity registers.

The Catch: The registry itself was not directly hacked. Instead, attackers used valid login credentials belonging to Lithuania’s Migration Department — an institution fully authorized to query the registers — to issue bulk queries from a foreign country at scale.

📉 2. The Fallout

Executive Resignation: The head of the State Enterprise Centre of Registers, Adrijus Jusas, resigned on May 26.
High-Level Compromise: Lithuanian President Gitanas Nausėda confirmed his own personal data was compromised. He declared at an emergency meeting of the State Defence Council that “hostile states” orchestrated the theft, placing the incident squarely within Russia’s ongoing hybrid war against Europe.
Physical Security Risks: The stolen data potentially includes the home addresses of intelligence officers, military personnel, diplomats, and politicians. Knowing where an operative lives is often the first tactical step in physical targeting or espionage. It also risks exposing exiled Russian and Belarusian dissident organizations operating through Lithuanian corporate structures.

🛠 3. The Blindspot (Why It Happened)

Insufficient Anomaly Detection: Legitimate credentials were used to extract hundreds of thousands of records from a foreign IP, yet no geographic access controls or volumetric flags triggered an alert.
Weak Credential Hygiene: The authorized institutions lacked enforced multi-factor authentication (MFA), strict session-origin controls, or automated rotation schedules.
Permissive Architecture: The data layer lacked role-based query limits, making mass data exfiltration structurally possible for a single session.

💬 Expert Analysis by Security Expert Group (SEG)

🔬 “This case is a clear example of how a trusted institutional connection can become the ultimate attack path. The breach did not depend on malware, but rather on authorized third-party credentials abused at scale. For organizations subject to NIS2 or ISO 27001, the lesson is clear: third-party access must be treated as a high-risk security boundary with technical controls that prevent mass extraction.”

🎯 How Security Expert Group (SEG) Protects Your Business

If your organization relies on data-sharing partnerships, your current security posture is only as strong as the weakest credential held outside your walls. At Security Expert Group, we provide tailored solutions to eliminate these exact supply chain vulnerabilities:

Third-Party Risk Assessments & Supply Chain Audits: We evaluate credential management, authentication hygiene, and access controls across your entire partner ecosystem to ensure external credentials cannot be leveraged against you.
Data Access Architecture Reviews: We help segment and classify your sensitive register data, implementing strict role-based query limits to make bulk data extraction structurally impossible.
Anomaly Detection & Monitoring Implementation: We deploy real-time monitoring and technical controls designed to flag and block unusual query volumes, pattern anomalies, or foreign-origin sessions — even if the requesting credential is completely valid.