Lithuania Property Data Leak: What Affected People Can Do
By the demoduck.co.uk international desk
A major data leak involving Lithuania’s state property register has raised practical questions for residents, property owners and businesses whose personal or real-estate information may have been exposed.
Publicly available information indicates that more than 600,000 records were unlawfully copied from Lithuania’s Real Estate Register, operated by Registrų centras. The case matters beyond Lithuania because it shows how property data, identity data and official records can become a powerful tool for targeted fraud when held together in one place.
For people with ties to Lithuania, including those living abroad, the main question is not only whether data was leaked. It is what criminals could do with information that appears official, detailed and personal.
What appears to have been leaked
The copied records reportedly included names, surnames, Lithuanian personal identity numbers, property register entry numbers, unique property numbers, addresses and other real-estate details.
The data may also include information about property rights, the basis on which those rights were registered, document names, dates and numbers, and other information normally visible in a register extract.
That combination is sensitive because it can describe a person’s financial and property situation in detail: what they own, where it is located, when it was acquired and, in some cases, whether rights or obligations are attached to it.
Lithuania’s State Data Protection Inspectorate and National Cyber Security Centre have opened inquiries. The Prosecutor General’s Office has also opened a pre-trial investigation into alleged unlawful access to information systems.
Why property data can be dangerous in the wrong hands
A property register is not just an address book. It can act as a map of a person’s assets and legal position. For criminals, that can make scams more convincing.
A fraudster who already knows a person’s full name, address and property details can sound more credible when pretending to be from a bank, notary office, public authority or debt-related service. This is the same wider problem seen in many European data incidents: the most serious harm often comes later, when leaked information is reused in social engineering.
Possible risks include:
- Targeted phone calls from criminals using real property details to build trust.
- Phishing emails or text messages that look official and include personalised references.
- Attempts to pressure or blackmail people whose property situation appears complicated, such as those with mortgages, disputes or enforcement issues.
The practical risk is therefore not limited to the initial copying of files. It lies in how those files may be combined with other information and used over time.
The legal position under EU data protection rules
Under the General Data Protection Regulation, a personal data breach can give affected people the right to seek compensation for material and non-material damage. Material damage may include lost money, extra security costs or business losses. Non-material damage may include distress, anxiety, loss of privacy or psychological discomfort.
The legal challenge is proof. Affected people would normally need to show that a breach occurred, that their own data was involved, and that they suffered damage because of it.
In this case, official investigations may become important because they can help establish the scale of the incident, the type of data involved and who was responsible. If a person later receives a suspicious call or loses money in a scam where the caller used leaked property details, that may help form a chain of evidence.
European case law has increasingly recognised that non-financial harm from data breaches can be real, even where there is no direct monetary loss. However, compensation is not automatic. Courts still examine the facts, the seriousness of the impact and the evidence linking the harm to the breach.
For Lithuanian state-sector data leaks, this incident could become an important test case. In other EU countries, courts and regulators have already dealt with major breach claims involving public bodies and large companies, while Lithuania has more experience with compensation claims against private organisations.
What affected people should do now
People who may be affected should first check official channels rather than rely on social media claims or unsolicited messages. If Registrų centras provides a self-service check, that is the appropriate place to confirm whether personal records were included.
It is also sensible to keep evidence. Save suspicious emails, text messages and call logs, especially if the sender or caller refers to property details. Do not click links in messages claiming to offer urgent checks or compensation. Access official services by typing the address yourself or using trusted government portals.
If money has been lost, contact the bank and police immediately and keep all documents connected with the incident. Businesses should document any losses, operational disruption or misuse of leaked company-related property information.
People experiencing significant anxiety or stress should also keep a record of the impact. Where appropriate, support from a medical or psychological professional may later help demonstrate non-material damage.
The sober view is that compensation may be possible, but it will depend on evidence. The strongest claims are likely to be those where an affected person can show that their data was included, that the information was later misused, and that measurable harm followed.
For readers outside Lithuania, the lesson is broader: official property and identity databases are high-value targets. When they are breached, the consequences may not arrive as one dramatic event, but as months of more convincing fraud attempts.
Source: BNS
Source check Source trail
This article adapts Lithuanian source material into a practical English-language guide and separates confirmed reported details from possible legal outcomes.
- Checked the reported categories of data copied from Lithuania's Real Estate Register.
- Checked which Lithuanian authorities were reported to have opened inquiries or investigati...
- Separated GDPR compensation rights from the harder question of proving individual damage.
- Added reader-facing fraud risks without stating that misuse has already occurred.
- Source
- bns
- Scope
- Lithuania
- Updated
- 2026-05-27 11:14
Source check
Report a trust issue
Send a clear signal to community moderation if the source, facts or context need review.
Comments