Lithuania Says 600,000 Register Records Pulled Through a Migration Department Login
Lithuania's Prosecutor General's Office says more than 600,000 records were pulled from the Centre of Registers using valid Migration Department login credentials issued queries from abroad. The registry itself was not breached — an authorized third party's login was.
The Lithuania breach is not a hack of the national register — it is the abuse of an authorized third party's login, and the strength of any government data system is now set by the weakest credential held outside it.
VILNIUS, LITHUANIA — Lithuania's Prosecutor General's Office confirmed on May 22, 2026 that attackers gained unauthorized access to more than 600,000 records held by the Centre of Registers (Registrų centras) — the state agency that maintains the country's real estate and legal-entity registers. According to the prosecutor's office and reporting by The Record, SecurityWeek, Euronews, LRT, and the Washington Times, the breach did not come from a direct intrusion into the registry's systems. It came through valid login credentials belonging to accounts at Lithuania's Migration Department, an institution authorized to query the registers, which were used to issue multiple unauthorized logins and queries from a foreign country.
Lithuanian authorities suspect foreign-state involvement and have declined to publicly name the country. An opposition lawmaker, Laurynas Kasčiūnas, publicly attributed the operation to Russian intelligence in a social-media post, offering no public evidence; the prosecutor's office has not endorsed that attribution. Adrijus Jusas, head of the Centre of Registers, resigned on Monday, and authorities have blocked the accounts of suspected data users, restricted access, and required affected institutions to update credentials.
What Happened
The Prosecutor General's Office statement, and the reporting it has anchored across The Record, SecurityWeek, Euronews, LRT, and the Washington Times, describes a specific sequence: attackers operating from outside Lithuania used valid login credentials belonging to accounts at the Migration Department to authenticate into the Centre of Registers' systems and issue queries that ultimately pulled more than 600,000 records, primarily from the real-estate and legal-entity registers. The Migration Department is an institution authorized to query the registers as part of its lawful operations, which is the reason the access was treated as legitimate at the moment it occurred. What is not known — and what the prosecutor's office has not stated publicly — is how those Migration Department credentials came into the attackers' hands. Phishing, password reuse, a prior intrusion, or an insider channel are all consistent with the available facts; none has been confirmed.
Two attribution claims sit alongside each other and should not be conflated. The first is the prosecutor's office's: that Lithuanian authorities suspect a foreign country and declined to publicly name which one. The second is from Laurynas Kasčiūnas, an opposition lawmaker, who attributed the operation to Russian intelligence on social media and offered no public evidence for that claim. The prosecutor's office has not endorsed Kasčiūnas's attribution, and no public technical or intelligence-product evidence has been released to support it. The response on the Lithuanian side has been immediate and accountability-oriented: Adrijus Jusas, head of the Centre of Registers, resigned on Monday, and authorities have blocked the accounts of suspected data users, restricted access, and required affected institutions to update their credentials. Several material facts remain unsettled — which specific records were exfiltrated, whether any of the data has appeared in public or criminal channels, whether other Lithuanian state agencies' credentials are also compromised, and when the unauthorized access began.
The Registry Was Not Hacked — an Authorized Login Was Abused
The most important sentence in the Lithuanian Prosecutor General's Office's statement is the one that says, by implication, what did not happen: the Centre of Registers' systems were not directly intruded. There is no exploitation of a vulnerability in the registry, no compromise of the registry's perimeter, no breach in the conventional sense of attackers fighting their way into a target system. The attackers walked in with a key that the system was designed to accept — valid Migration Department credentials, used in a session that the registry, by design, treated as a legitimate query from an authorized partner agency. That distinction is not a technicality. It changes which controls would have made a difference: a more thoroughly patched registry would not have stopped this, but anomaly detection on the registry side, or phishing-resistant authentication on the Migration Department side, might have. For a national-data environment, the operational truth is that the strength of access controls is set by the weakest of the institutions you trust with credentials, not by the strength of the system holding the data.
Attribution Is Suspected, Not Confirmed — and the Two Claims Are Not the Same
Coverage of this incident will frequently lead with the word 'Russia,' and it is important to be precise about what is on the record. Lithuanian authorities have stated that they suspect a foreign country was involved; the prosecutor's office has not publicly named which country. Separately, opposition lawmaker Laurynas Kasčiūnas attributed the operation to Russian intelligence in a personal social-media post, and that claim has not been backed by public technical evidence or endorsed by the prosecutor's office. These are two different statements with two different weights. Lithuania is a NATO member, a Baltic state, an EU member with a Russian border, and has been a frequent target of Russia-aligned cyber and influence operations, so attribution to Russian intelligence is a hypothesis with geopolitical plausibility. Plausibility, however, is not evidence. Other capable foreign services — including services that have shown sustained interest in NATO eastern-flank countries — could be consistent with the same facts, and the responsible reading of the prosecutor's office's reticence is that the evidence has not yet supported a public attribution. For broader context on how Western intelligence agencies are currently framing nation-state cyber risk, see the NSA, FBI, and NCSC's joint advisory on China-nexus covert networks and Germany's recent warning on Chinese AI-augmented offensive capability — both of which describe sophisticated state cyber operations that are responsive to geopolitical events, the same pattern visible in Salt Typhoon's pivot to Azerbaijani oil and gas earlier this month.
A Third-Party Credential Pattern at National-State Scale
The Lithuania breach is not an isolated structural failure — it is the same failure pattern The CyberSignal has been tracking at smaller scales through the same week. On May 25, the published DocketWise breach roundup documented an immigration-software vendor incident in which an authorized partner's credentials were used to clone repositories, exposing sensitive data well outside the vendor's own perimeter. Days earlier, Trump Mobile's customer data exposure came through a third-party platform rather than the carrier itself. The Lithuania incident is the same pattern at national-state scale: the attackers did not target the data holder's defenses; they targeted the credentials of an authorized third party that was allowed inside those defenses. The structural lesson generalizes uncomfortably: if your environment grants any external party the ability to query large volumes of sensitive data, the security of that data depends on the security of an organization you do not control. The Verizon DBIR 2026 finding that vulnerability exploitation has just overtaken credential theft as the number-one initial-access method sits alongside this incident, not in opposition to it — credential abuse, especially of legitimate third-party accounts, remains a primary route into sensitive data even as overall access-method shares shift.
Scope and Impact
The scope of the exposure is, in the language of the prosecutor's office, 'more than 600,000 records' — primarily from the real-estate and legal-entity registers. What that figure does not yet contain is a public breakdown of how many individuals or entities are uniquely represented in those records, which categories of property or corporate filings were most heavily pulled, or whether the data has surfaced anywhere outside the operators' hands. The prosecutor's office has also not stated how the Migration Department's credentials were obtained, whether other Lithuanian state agencies' credentials are also compromised, or how long the unauthorized access went undetected before the foreign-origin logins triggered investigation. Each of those unknowns will materially shape the eventual assessment of damage.
Lithuania's geopolitical position is part of the operational context but should not be treated as part of the attribution. The country has a population of roughly 2.9 million, is a NATO and EU member, shares a border with the Russian exclave of Kaliningrad, and has been a frequent target of Russia-aligned cyber and influence operations across recent years. That history is the reason a foreign-state hypothesis is on the table at all. It is not the reason any specific state has been named; the prosecutor's office has explicitly not named one. The honest summary is that a sophisticated foreign actor with the capability and motivation to obtain Migration Department credentials and operate from outside Lithuania is the working hypothesis, and that the specific identity of that actor has not been publicly established.
Response and Attribution
The Lithuanian response has prioritized two things — containment and accountability. On containment, authorities blocked the accounts of suspected data users, restricted access to the registers, and required affected institutions to update credentials; those steps close the immediately abused channel and force re-authentication across the partner ecosystem. On accountability, Adrijus Jusas, head of the Centre of Registers, resigned on Monday — a signal that the European executive-accountability norm for state cybersecurity failures has tightened. Beyond those steps, the work of the investigation is now to reconstruct how the Migration Department's credentials were obtained, when unauthorized access began, what was actually pulled, and whether other authorized institutions are exposed. None of those answers is public yet.
For government and public-sector CISOs, especially in NATO and EU eastern-flank states, the practical takeaways are concrete. Audit every institution and partner that holds query credentials into national or sectoral registers, and treat the registry's defensive posture as the union of all those credential holders' defensive postures — not as its own. Require phishing-resistant multi-factor authentication, ideally FIDO2 or hardware tokens, for any cross-agency access to sensitive data systems. Implement anomaly detection on the registry side itself — queries from unexpected geographic regions, unusual volumes, or atypical access patterns should trigger automatic blocks and human review rather than be logged after the fact. Enforce credential rotation and re-attestation for cross-agency access, and consider just-in-time access models that grant query rights only when needed and revoke them when the task is complete.
For all CISOs, the framing matters: data is only as protected as the credentials of the third parties granted access to it. Quantify your third-party credential exposure as a board-level metric — how many external accounts can reach your most sensitive systems, what scope of access they hold, what authentication strength they use, and what monitoring you apply to their behavior once they are inside. For policy and government engagement, the Lithuania incident strengthens the case for mandatory phishing-resistant MFA on credentials accessing critical government systems, and the accountability response of the Centre of Registers head's resignation signals a tightening of European executive-accountability norms that boards in other member states should expect to face if a comparable failure occurs in their own environments.
The CyberSignal Analysis
Signal 01 — The Weakest Credential Defines the System's Security
Most coverage will lead with the 600,000-record figure or the suspected-Russia framing, and both will travel further than they should. The detail that matters most is the mechanism: a national registry was not breached; an authorized third party's login was. That changes the defensive lesson entirely. Investments in the registry's own perimeter — patching, segmentation, intrusion detection — would not have stopped what happened, because the access path used was, by design, legitimate. The control that would have mattered is the one applied to the credentials held by the partner agency, and on the registry side, the anomaly detection that would have flagged a routine query suddenly originating from outside the country. The generalizable rule for any government or critical-services environment is that the security of the data holder is, in practice, the security of the weakest of the institutions trusted with credentials. That fact has to be reflected in how partner access is provisioned, authenticated, and monitored — not as a back-office hygiene matter but as a board-level statement of risk.
Signal 02 — Suspected Is Not Confirmed, and the Distinction Is the Story
There is a real journalistic temptation, and a real political temptation, to translate 'Lithuanian authorities suspect a foreign country' into 'Russia did it.' The temptation should be resisted, and not for diplomatic reasons. Premature attribution closes off investigative paths, hardens public narratives before evidence supports them, and creates the conditions for false-flag operations to succeed in the future. The prosecutor's office's decision to suspect but not name a country is the responsible posture given what is publicly known. The lawmaker's separate, evidence-free attribution to Russian intelligence is a political claim, not an intelligence finding, and should be treated as such. For analysts and security leaders, the operational impact of attribution is real — Russian intelligence, Chinese intelligence, and other capable services operate with different tradecraft, target priorities, and post-exfiltration behaviors — and treating an unconfirmed claim as confirmed risks tuning defensive and intelligence work to the wrong adversary.
Signal 03 — Third-Party Credential Abuse Is the Pattern of the Week, at Three Scales
Three CyberSignal stories in roughly seven days describe the same failure pattern at three different scales: Trump Mobile's customer data exposure through a third-party platform; the DocketWise immigration-software breach through an authorized partner's credentials; and now the Lithuanian national registers through a partner agency's logins. The pattern is what changes the analysis. This is not a coincidence and not a vendor problem; it is a structural feature of how modern data ecosystems work. Every organization that grants external parties the ability to authenticate into its sensitive systems has inherited those parties' authentication weaknesses, and most organizations have not measured that inheritance. The defensive work is concrete and unglamorous — inventory every external credential with access to sensitive data, demand phishing-resistant authentication for those credentials, instrument the receiving side for anomaly detection on partner queries, and apply executive-level accountability to a third-party credential program in the same way it is applied to first-party security. The Lithuania incident is the highest-stakes example of the pattern this week; the next one will be next week.
