Lithuanian travelers’ personal records spanning from 2012 to 2026, including passport copies and contact details, have appeared on the Russian dark web.
Inspectorate Launches Official Inquiry Into Tez Tour
The State Data Protection Inspectorate initiated an official inspection following public disclosures that personal data belonging to Lithuanian travelers surfaced on underground Russian platforms. The regulatory body formally contacted travel organizer Tez Tour to examine whether domestic customer systems suffered a security breach, though officials stress this step marks an active inquiry rather than a confirmed violation.
Company representatives have pushed back against claims of a domestic breach. Inga Aukštuolytė, head of public relations and marketing for Tez Tour, stated that an internal review was launched to analyze the situation seriously, yet maintained that no unauthorized extraction of Lithuanian traveler data was recorded within company systems. The National Cyber Security Center informed reporters that it holds no record of a cyber incident within the company’s direct infrastructure, directing all inquiries to the data protection regulator.
Exposed Records Span Fourteen Years of Bookings
The exposed repository contains traveler entries dated between 2012 and 2026. Experts emphasize that this chronological range reflects the span of dates found within the database rather than a continuous breach window or a confirmed exfiltration timestamp.
The dataset includes identity details, dates of birth, personal codes, passport copies, document numbers, phone numbers, and specific travel itineraries alongside pricing. Database entries reference several prominent Lithuanian travel operators and agencies, creating widespread concern across the industry.
Multiple Travel Operators Named in the Leaked Files
Security researchers found company names associated with traveler bookings across a broad cross-section of the Lithuanian travel market. The presence of a corporate brand inside a leaked file does not automatically prove that an intrusion occurred within that specific agency’s network, as data routing and third-party booking channels complicate the origin.
- Tez Tour
- Makalius
- Kelionių ekspresas
- West Express
- Noriu atostogų
- Kelionių akademija
- Baltic Tours
- Amberturas
Lawsuits Expected as Personal Code Security Is Debated
Legal professionals anticipate fallout from the incident. Attorney Inga Abramavičiūtė noted that both collective and individual lawsuits are expected as legal teams evaluate the scope of the exposure. Beyond civil litigation, the breach reignited policy debates regarding whether Lithuania should alter its personal code system, which currently treats national identification numbers as identifiers despite their widespread use across banking and digital services.
Security analysts point out that while a passport copy alone cannot legally authorize a bank loan or serve as a valid international travel document, it introduces substantial risks when combined with other stolen credentials. Fraudsters can utilize exact travel dates and pricing details to make spear-phishing phone calls appear genuine, posing as agency staff to extract additional payments from unsuspecting consumers.
Official Guidance Issued for Concerned Travelers
Authorities advise affected individuals to exercise caution and avoid unverified third-party verification tools. Consumers are urged to contact their travel providers directly through official web domains.